kibershield-x-windows-amd64-setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
kibershield-x-windows-amd64-setup.exe
Size 32.4MB
Sample260801-jtxpcsfg85
SHA256 9302d845f4edec9741ae324988c94b5c15762134738040ccd0bb77bbb7de1295
MD5 b7bb48a90265d5e0aa211831405223f1
SHA1 7d1a7a4e8288456585914923434e3530399e9da4
SHA512 65371d3ed5fbe1419e2c61dfca1ff15ea783241de946474d04d67b939a8f4014da62e998ce989792a3456ab0b48c3627620f50dc95fd4007b88f1aa7dd9e7be3
SSDEEP 786432:aa5MbYqzxpx3DEB4dlTRhQYNBddPx/+J4OWtQ+vLe:aPbYqBzdlTDQYJd9i
TLSH
T1C9773380D53E8EF1C0E2F7B926EC55920CE4391308F19C7B7D2AD4B2A9E39568E3E551
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/libcronet.dll
unpack001/КИБЕРЩИТ ／／ X.exe
unpack001/КИБЕРЩИТ ／／ XCore.exe

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
kibershield-x-windows-amd64-setup.exe

File Explorer

kibershield-x-windows-amd64-setup.exe

.exe 32.4MB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/UserInfo.dll

.dll 4KB
$PLUGINSDIR/kill_kibershield_processes.ps1

416B
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsExec.dll

.dll 7KB
AppIcon.ico

95KB
LICENSE-KIBERSHIELD-X.txt

1KB
libcronet.dll

.dll 9.0MB
КИБЕРЩИТ ／／ X.exe

.exe 54.1MB
КИБЕРЩИТ ／／ XCore.exe

.exe 62.3MB

kibershield-x-windows-amd64-setup.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 9302d845f4edec9741ae324988c94b5c15762134738040ccd0bb77bbb7de1295
MD5 b7bb48a90265d5e0aa211831405223f1
SHA1 7d1a7a4e8288456585914923434e3530399e9da4
SHA512 65371d3ed5fbe1419e2c61dfca1ff15ea783241de946474d04d67b939a8f4014da62e998ce989792a3456ab0b48c3627620f50dc95fd4007b88f1aa7dd9e7be3
SSDEEP 786432:aa5MbYqzxpx3DEB4dlTRhQYNBddPx/+J4OWtQ+vLe:aPbYqBzdlTDQYJd9i
TLSH
T1C9773380D53E8EF1C0E2F7B926EC55920CE4391308F19C7B7D2AD4B2A9E39568E3E551
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

61:cb:4a:4d:1c:a4:53:fc:a0:63:12:5e:01:ef:68:50:d1:af:fb:53:90:16:8e:1f:55:d5:fb:30:50:79:76:e3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Kibershield X Code Signing,O=Kibershield,C=RU

Chains

Jul 30, 2026

CN=Kibershield X Code Signing,O=Kibershield,C=RU

Subject

CN=Kibershield X Code Signing,O=Kibershield,C=RU

Serial Number

62:85:0e:10:4b:6a:a1:a9:47:d3:b6:65:f5:9a:fe:36

Issuer

CN=Kibershield X Code Signing,O=Kibershield,C=RU

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 21, 2026 - Jun 21, 2031

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH 68e847ed6763e00454edac87b3abd95a
SHA256 0893c4d31c7d9c2106eea64f10d6b17a00b742727662a883c39990bcee6a7d15
MD5 a189f9b1c9ef05e23e5aed0bdb2a1bf4
SHA1 584e9461cbb901aecabe61b4c3fbed146da0035f
SHA512 d9f34ea10b8174c031b25dace65f092dacd0e582e3b8cf1779ca9721f50a896cdd3be2cb6738a7ae487a3f8dc1b4548045ac6ca875138003903b0e6e055412ee
TLSH
T1EE8173BB92E00CF3D0A44BB740A71CE362B5DD201756001F4A478AA92590B67EE7E715
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
MD5 cf0351a2ab9128838be6b54cea8238d3
SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
TLSH
T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 68b7023f8923dd087549802f8fa631c3
SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
MD5 c953dd0aab774f1446fcd63fa7c5f613
SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
TLSH
T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

libcronet.dll

IMPHASH a9cff5fb60445912b11f2f00b47acf1c
SHA256 c7434cfa93c3041321dd19111c4de6c52b8a9531a65661ba45425d3c51ec69e2
MD5 72ae38a69dc9ced1a13f1ed58d943585
SHA1 e977eb3d0b79992c27fbee9151da7407b38e978a
SHA512 f87d6335035d1452c9bd5ab1a07cdfa7380623b1451084358a923602eeb4315249d8588442115a4877c8754c1fb8e4709e19fc148e6f3676796b75abc9a9dbe3
SSDEEP 98304:hlOTNPRHJWVfW2m3tdB+JblCblDwybHULDWayIto1YyeLuNZShGp1b9:eThAfWPB+JblCblDwybHmoFeqLb
TLSH
T19D965B43F29651EDC019D079971B9232BA71BC494B3579EF0B90BB612E72BE0A73DB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7602464

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

cronet.dll.pdb

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared CloseHandle CompareStringW CopyFileW CreateDirectoryW CreateEventW CreateFileMappingW CreateFileW CreateIoCompletionPort CreateThread DeleteCriticalSection DeleteFileW DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushViewOfFile FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessTimes GetProductInfo GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathW GetThreadContext GetThreadId GetThreadPriority GetThreadPriorityBoost GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetVersionExW GetWindowsDirectoryW GlobalFree GlobalMemoryStatusEx InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead InitializeSRWLock InterlockedFlushSList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32GetModuleInformation LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile MoveFileExW MoveFileW MultiByteToWideChar OpenThread OutputDebugStringA PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile RegisterWaitForSingleObject ReleaseSRWLockExclusive ReleaseSRWLockShared RemoveDirectoryW ReplaceFileW ResetEvent ResumeThread RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointer SetFilePointerEx SetInformationJobObject SetLastError SetStdHandle SetThreadInformation SetThreadPriority SetThreadPriorityBoost SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SuspendThread SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TzSpecificLocalTimeToSystemTime UnhandledExceptionFilter UnmapViewOfFile UnregisterWaitEx VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

advapi32

BuildTrusteeWithSidW CheckTokenMembership ConvertStringSidToSidW GetLengthSid GetNamedSecurityInfoW GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetTokenInformation IsValidAcl IsValidSecurityDescriptor IsValidSid RegCloseKey RegCreateKeyExW RegNotifyChangeKeyValue RegOpenKeyExW RegQueryValueExW SetEntriesInAclW SetNamedSecurityInfoW SetSecurityInfo

dbghelp

SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetModuleInfo64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW

ws2_32

WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEnumProtocolsW WSAEventSelect WSAGetLastError WSAGetOverlappedResult WSAIoctl WSARecv WSARecvFrom WSAResetEvent WSASend WSASendTo WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo gethostname getpeername getsockname getsockopt htonl htons inet_ntop ioctlsocket ntohs recv recvfrom sendto setsockopt shutdown socket

shell32

CommandLineToArgvW SHGetFolderPathW SHGetKnownFolderPath

iphlpapi

if_indextoname

winmm

timeBeginPeriod timeEndPeriod timeGetTime

shlwapi

PathMatchSpecW

ole32

CoInitializeEx CoRegisterInitializeSpy CoRevokeInitializeSpy CoTaskMemFree CoUninitialize

winhttp

WinHttpCloseHandle WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpOpen WinHttpSetTimeouts

user32

CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW GetQueueStatus KillTimer MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW PostQuitMessage RegisterClassExW SetTimer TranslateMessage UnregisterClassW

secur32

AcquireCredentialsHandleW DeleteSecurityContext FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW QuerySecurityPackageInfoW

crypt32

CertAddStoreToCollection CertCloseStore CertControlStore CertEnumCertificatesInStore CertFindCertificateInStore CertGetEnhancedKeyUsage CertOpenStore CryptProtectMemory CryptUnprotectMemory

api-ms-win-core-winrt-l1-1-0

RoInitialize RoUninitialize

ntdll

NtQueryInformationThread

Cronet_BufferCallback_CreateWith Cronet_BufferCallback_Destroy Cronet_BufferCallback_GetClientContext Cronet_BufferCallback_OnDestroy Cronet_BufferCallback_SetClientContext Cronet_Buffer_Create Cronet_Buffer_CreateWith Cronet_Buffer_Destroy Cronet_Buffer_GetClientContext Cronet_Buffer_GetData Cronet_Buffer_GetSize Cronet_Buffer_InitWithAlloc Cronet_Buffer_InitWithDataAndCallback Cronet_Buffer_SetClientContext Cronet_CreateCertVerifierWithRootCerts Cronet_DateTime_Create Cronet_DateTime_Destroy Cronet_DateTime_value_get Cronet_DateTime_value_set Cronet_EngineParams_Create Cronet_EngineParams_Destroy Cronet_EngineParams_accept_language_get Cronet_EngineParams_accept_language_set Cronet_EngineParams_enable_brotli_get Cronet_EngineParams_enable_brotli_set Cronet_EngineParams_enable_check_result_get Cronet_EngineParams_enable_check_result_set Cronet_EngineParams_enable_http2_get Cronet_EngineParams_enable_http2_set Cronet_EngineParams_enable_public_key_pinning_bypass_for_local_trust_anchors_get Cronet_EngineParams_enable_public_key_pinning_bypass_for_local_trust_anchors_set Cronet_EngineParams_enable_quic_get Cronet_EngineParams_enable_quic_set Cronet_EngineParams_experimental_options_get Cronet_EngineParams_experimental_options_set Cronet_EngineParams_http_cache_max_size_get Cronet_EngineParams_http_cache_max_size_set Cronet_EngineParams_http_cache_mode_get Cronet_EngineParams_http_cache_mode_set Cronet_EngineParams_network_thread_priority_get Cronet_EngineParams_network_thread_priority_set Cronet_EngineParams_public_key_pins_add Cronet_EngineParams_public_key_pins_at Cronet_EngineParams_public_key_pins_clear Cronet_EngineParams_public_key_pins_size Cronet_EngineParams_quic_hints_add Cronet_EngineParams_quic_hints_at Cronet_EngineParams_quic_hints_clear Cronet_EngineParams_quic_hints_size Cronet_EngineParams_storage_path_get Cronet_EngineParams_storage_path_set Cronet_EngineParams_user_agent_get Cronet_EngineParams_user_agent_set Cronet_Engine_AddRequestFinishedListener Cronet_Engine_CloseAllConnections Cronet_Engine_Create Cronet_Engine_CreateWith Cronet_Engine_Destroy Cronet_Engine_GetClientContext Cronet_Engine_GetDefaultUserAgent Cronet_Engine_GetStreamEngine Cronet_Engine_GetVersionString Cronet_Engine_RemoveRequestFinishedListener Cronet_Engine_SetClientContext Cronet_Engine_SetDialer Cronet_Engine_SetMockCertVerifierForTesting Cronet_Engine_SetUdpDialer Cronet_Engine_Shutdown Cronet_Engine_StartNetLogToFile Cronet_Engine_StartWithParams Cronet_Engine_StopNetLog Cronet_Error_Create Cronet_Error_Destroy Cronet_Error_error_code_get Cronet_Error_error_code_set Cronet_Error_immediately_retryable_get Cronet_Error_immediately_retryable_set Cronet_Error_internal_error_code_get Cronet_Error_internal_error_code_set Cronet_Error_message_get Cronet_Error_message_set Cronet_Error_quic_detailed_error_code_get Cronet_Error_quic_detailed_error_code_set Cronet_Executor_CreateWith Cronet_Executor_Destroy Cronet_Executor_Execute Cronet_Executor_GetClientContext Cronet_Executor_SetClientContext Cronet_HttpHeader_Create Cronet_HttpHeader_Destroy Cronet_HttpHeader_name_get Cronet_HttpHeader_name_set Cronet_HttpHeader_value_get Cronet_HttpHeader_value_set Cronet_Metrics_Create Cronet_Metrics_Destroy Cronet_Metrics_connect_end_get Cronet_Metrics_connect_end_set Cronet_Metrics_connect_start_get Cronet_Metrics_connect_start_set Cronet_Metrics_dns_end_get Cronet_Metrics_dns_end_set Cronet_Metrics_dns_start_get Cronet_Metrics_dns_start_set Cronet_Metrics_push_end_get Cronet_Metrics_push_end_set Cronet_Metrics_push_start_get Cronet_Metrics_push_start_set Cronet_Metrics_received_byte_count_get Cronet_Metrics_received_byte_count_set Cronet_Metrics_request_end_get Cronet_Metrics_request_end_set Cronet_Metrics_request_start_get Cronet_Metrics_request_start_set Cronet_Metrics_response_start_get Cronet_Metrics_response_start_set Cronet_Metrics_sending_end_get Cronet_Metrics_sending_end_set Cronet_Metrics_sending_start_get Cronet_Metrics_sending_start_set Cronet_Metrics_sent_byte_count_get Cronet_Metrics_sent_byte_count_set Cronet_Metrics_socket_reused_get Cronet_Metrics_socket_reused_set Cronet_Metrics_ssl_end_get Cronet_Metrics_ssl_end_set Cronet_Metrics_ssl_start_get Cronet_Metrics_ssl_start_set Cronet_PublicKeyPins_Create Cronet_PublicKeyPins_Destroy Cronet_PublicKeyPins_expiration_date_get Cronet_PublicKeyPins_expiration_date_set Cronet_PublicKeyPins_host_get Cronet_PublicKeyPins_host_set Cronet_PublicKeyPins_include_subdomains_get Cronet_PublicKeyPins_include_subdomains_set Cronet_PublicKeyPins_pins_sha256_add Cronet_PublicKeyPins_pins_sha256_at Cronet_PublicKeyPins_pins_sha256_clear Cronet_PublicKeyPins_pins_sha256_size Cronet_QuicHint_Create Cronet_QuicHint_Destroy Cronet_QuicHint_alternate_port_get Cronet_QuicHint_alternate_port_set Cronet_QuicHint_host_get Cronet_QuicHint_host_set Cronet_QuicHint_port_get Cronet_QuicHint_port_set Cronet_RequestFinishedInfoListener_CreateWith Cronet_RequestFinishedInfoListener_Destroy Cronet_RequestFinishedInfoListener_GetClientContext Cronet_RequestFinishedInfoListener_OnRequestFinished Cronet_RequestFinishedInfoListener_SetClientContext Cronet_RequestFinishedInfo_Create Cronet_RequestFinishedInfo_Destroy Cronet_RequestFinishedInfo_annotations_add Cronet_RequestFinishedInfo_annotations_at Cronet_RequestFinishedInfo_annotations_clear Cronet_RequestFinishedInfo_annotations_size Cronet_RequestFinishedInfo_finished_reason_get Cronet_RequestFinishedInfo_finished_reason_set Cronet_RequestFinishedInfo_metrics_get Cronet_RequestFinishedInfo_metrics_set Cronet_Runnable_CreateWith Cronet_Runnable_Destroy Cronet_Runnable_GetClientContext Cronet_Runnable_Run Cronet_Runnable_SetClientContext Cronet_UploadDataProvider_Close Cronet_UploadDataProvider_CreateWith Cronet_UploadDataProvider_Destroy Cronet_UploadDataProvider_GetClientContext Cronet_UploadDataProvider_GetLength Cronet_UploadDataProvider_Read Cronet_UploadDataProvider_Rewind Cronet_UploadDataProvider_SetClientContext Cronet_UploadDataSink_CreateWith Cronet_UploadDataSink_Destroy Cronet_UploadDataSink_GetClientContext Cronet_UploadDataSink_OnReadError Cronet_UploadDataSink_OnReadSucceeded Cronet_UploadDataSink_OnRewindError Cronet_UploadDataSink_OnRewindSucceeded Cronet_UploadDataSink_SetClientContext Cronet_UrlRequestCallback_CreateWith Cronet_UrlRequestCallback_Destroy Cronet_UrlRequestCallback_GetClientContext Cronet_UrlRequestCallback_OnCanceled Cronet_UrlRequestCallback_OnFailed Cronet_UrlRequestCallback_OnReadCompleted Cronet_UrlRequestCallback_OnRedirectReceived Cronet_UrlRequestCallback_OnResponseStarted Cronet_UrlRequestCallback_OnSucceeded Cronet_UrlRequestCallback_SetClientContext Cronet_UrlRequestParams_Create Cronet_UrlRequestParams_Destroy Cronet_UrlRequestParams_allow_direct_executor_get Cronet_UrlRequestParams_allow_direct_executor_set Cronet_UrlRequestParams_annotations_add Cronet_UrlRequestParams_annotations_at Cronet_UrlRequestParams_annotations_clear Cronet_UrlRequestParams_annotations_size Cronet_UrlRequestParams_disable_cache_get Cronet_UrlRequestParams_disable_cache_set Cronet_UrlRequestParams_http_method_get Cronet_UrlRequestParams_http_method_set Cronet_UrlRequestParams_idempotency_get Cronet_UrlRequestParams_idempotency_set Cronet_UrlRequestParams_priority_get Cronet_UrlRequestParams_priority_set Cronet_UrlRequestParams_request_finished_executor_get Cronet_UrlRequestParams_request_finished_executor_set Cronet_UrlRequestParams_request_finished_listener_get Cronet_UrlRequestParams_request_finished_listener_set Cronet_UrlRequestParams_request_headers_add Cronet_UrlRequestParams_request_headers_at Cronet_UrlRequestParams_request_headers_clear Cronet_UrlRequestParams_request_headers_size Cronet_UrlRequestParams_upload_data_provider_executor_get Cronet_UrlRequestParams_upload_data_provider_executor_set Cronet_UrlRequestParams_upload_data_provider_get Cronet_UrlRequestParams_upload_data_provider_set Cronet_UrlRequestStatusListener_CreateWith Cronet_UrlRequestStatusListener_Destroy Cronet_UrlRequestStatusListener_GetClientContext Cronet_UrlRequestStatusListener_OnStatus Cronet_UrlRequestStatusListener_SetClientContext Cronet_UrlRequest_Cancel Cronet_UrlRequest_Create Cronet_UrlRequest_CreateWith Cronet_UrlRequest_Destroy Cronet_UrlRequest_FollowRedirect Cronet_UrlRequest_GetClientContext Cronet_UrlRequest_GetStatus Cronet_UrlRequest_InitWithParams Cronet_UrlRequest_IsDone Cronet_UrlRequest_Read Cronet_UrlRequest_SetClientContext Cronet_UrlRequest_Start Cronet_UrlResponseInfo_Create Cronet_UrlResponseInfo_Destroy Cronet_UrlResponseInfo_all_headers_list_add Cronet_UrlResponseInfo_all_headers_list_at Cronet_UrlResponseInfo_all_headers_list_clear Cronet_UrlResponseInfo_all_headers_list_size Cronet_UrlResponseInfo_http_status_code_get Cronet_UrlResponseInfo_http_status_code_set Cronet_UrlResponseInfo_http_status_text_get Cronet_UrlResponseInfo_http_status_text_set Cronet_UrlResponseInfo_negotiated_protocol_get Cronet_UrlResponseInfo_negotiated_protocol_set Cronet_UrlResponseInfo_proxy_server_get Cronet_UrlResponseInfo_proxy_server_set Cronet_UrlResponseInfo_received_byte_count_get Cronet_UrlResponseInfo_received_byte_count_set Cronet_UrlResponseInfo_url_chain_add Cronet_UrlResponseInfo_url_chain_at Cronet_UrlResponseInfo_url_chain_clear Cronet_UrlResponseInfo_url_chain_size Cronet_UrlResponseInfo_url_get Cronet_UrlResponseInfo_url_set Cronet_UrlResponseInfo_was_cached_get Cronet_UrlResponseInfo_was_cached_set GetHandleVerifier bidirectional_stream_cancel bidirectional_stream_create bidirectional_stream_delay_request_headers_until_flush bidirectional_stream_destroy bidirectional_stream_disable_auto_flush bidirectional_stream_flush bidirectional_stream_read bidirectional_stream_start bidirectional_stream_write

Name

.text

Size

7.5MB

Virtual Size

7.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

58KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

195KB

Virtual Size

195KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

malloc_h

Size

512B

Virtual Size

304B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

prot

Size

512B

Virtual Size

116B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

КИБЕРЩИТ ／／ X.exe

IMPHASH b8a007403eb3c5a12e6336b7801cdeb8
SHA256 24ea418d267eee86fae550ecf49eda6a4d9a30335d79b6b8d4e3dc689c27fc11
MD5 985d2d612ea9c3233c5225a1febb5896
SHA1 7c827931afbfed82485a8dc59e8c4ff3e211d03a
SHA512 3028be342b33e676e2730cab9f21d91034f864d54e7f1403e7f845fec31aca8e4af005d284cb04528602d76fde2a2ae38d465efbd44844cc9906a10aed7c6388
SSDEEP 393216:uupf70fkjDQfS1/8bec6DMSs9ul/7ghKWsdBSKFdu9CwJsv6t1VPV9Kx8ycs:Rd70qUbX3ul/7SaB6VPnyh
TLSH
T11AC78C0772F90185E5BBC1798BA78627EBB2784543309BDF059492AD1E33EF44E3A325
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

268476

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Throne\build\КИБЕРЩИТ ／／ X.pdb

wininet

InternetSetOptionW InternetQueryOptionW

wsock32

closesocket getpeername __WSAFDIsSet listen select setsockopt WSAGetLastError getsockopt htons ntohl htonl WSAAsyncSelect WSACleanup WSAStartup bind recv send WSASetLastError ntohs inet_ntoa gethostbyname accept connect getsockname socket

ws2_32

WSANtohl WSAConnect WSANtohs WSARecv WSARecvFrom WSAHtonl WSAIoctl WSASocketW WSAAccept getnameinfo freeaddrinfo getaddrinfo WSASendTo WSASend

user32

CreatePopupMenu DestroyMenu GetDpiForWindow VkKeyScanW GetAsyncKeyState UnregisterHotKey RegisterHotKey SystemParametersInfoForDpi SystemParametersInfoW GetSysColor GetSystemMetricsForDpi EnableMenuItem InsertMenuW AppendMenuW ModifyMenuW RemoveMenu GetSystemMenu SetWindowLongPtrW GetWindowLongPtrW KillTimer SetCoalescableTimer SetTimer GetMenuItemInfoW GetQueueStatus DestroyWindow CreateWindowExW UnregisterClassW RegisterClassW DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage CharPrevExA EnumWindows LoadImageW CreateMenu UnregisterDeviceNotification RegisterDeviceNotificationW GetUserObjectInformationW GetProcessWindowStation DrawIconEx GetMonitorInfoW MonitorFromWindow MonitorFromPoint LoadIconW ChangeWindowMessageFilterEx RegisterClassExW GetClassInfoW GetPointerDeviceRects SkipPointerFrameMessages GetPointerPenInfoHistory GetPointerPenInfo GetPointerFrameTouchInfoHistory GetPointerFrameTouchInfo GetPointerType GetMessageExtraInfo TrackMouseEvent SetMenuDefaultItem TrackPopupMenuEx HiliteMenuItem MapVirtualKeyW ToUnicode ToAscii GetKeyboardState GetKeyState GetKeyboardLayoutNameW GetCursorInfo GetIconInfo CreateIconIndirect CreateCursor SetMenuItemInfoW DrawMenuBar SetMenu RemoveClipboardFormatListener AddClipboardFormatListener ChangeClipboardChain PostMessageW GetAncestor IsHungAppWindow PostThreadMessageW SendInput GetDisplayConfigBufferSizes QueryDisplayConfig DisplayConfigGetDeviceInfo MonitorFromRect EnumDisplayMonitors GetDisplayAutoRotationPreferences SetClipboardViewer GetWindowThreadProcessId MessageBoxW SetForegroundWindow GetForegroundWindow AttachThreadInput SetDisplayAutoRotationPreferences GetMessageW MsgWaitForMultipleObjectsEx DestroyCursor LoadCursorW GetCursor SetCursorPos FindWindowA SetCaretPos ShowCaret DestroyCaret CreateCaret IsWindowEnabled GetKeyboardLayout GetPointerInfo MoveWindow GetSystemMetrics GetDC ReleaseDC GetDesktopWindow SetParent GetDoubleClickTime IsWindow MessageBeep GetCaretBlinkTime DestroyIcon UpdateLayeredWindowIndirect GetKeyboardLayoutList RegisterWindowMessageW GetMessageTime RegisterPowerSettingNotification UnregisterPowerSettingNotification SetWindowPos GetWindowPlacement IsZoomed GetFocus InvalidateRect GetClientRect GetCursorPos ClientToScreen ScreenToClient WindowFromPoint ChildWindowFromPointEx GetParent GetThreadDpiAwarenessContext GetWindowDpiAwarenessContext AreDpiAwarenessContextsEqual IsValidDpiAwarenessContext EnableNonClientDpiScaling SetProcessDpiAwarenessContext ChangeWindowMessageFilter RegisterClipboardFormatW GetClipboardFormatNameW EnumDisplayDevicesW SendMessageW SendMessageTimeoutW IsChild ShowWindow UpdateLayeredWindow SetLayeredWindowAttributes FlashWindowEx SetWindowPlacement IsWindowVisible IsIconic BringWindowToTop SetFocus RegisterTouchWindow UnregisterTouchWindow IsTouchWindow GetCapture SetCapture ReleaseCapture GetMenu TrackPopupMenu SetActiveWindow BeginPaint EndPaint GetUpdateRect SetWindowRgn SetWindowTextW GetWindowRect AdjustWindowRectEx AdjustWindowRectExForDpi SetCursor MapWindowPoints GetWindow

rasapi32

RasEnumEntriesW

iphlpapi

ConvertInterfaceLuidToNameW ConvertInterfaceLuidToIndex ConvertInterfaceIndexToLuid GetAdaptersAddresses ConvertInterfaceNameToLuidW GetNetworkParams

ntdll

RtlLookupFunctionEntry RtlUnwindEx RtlUnwind NtQueryKey RtlVirtualUnwind RtlPcToFileHeader RtlGetVersion RtlCaptureContext

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea DwmEnableBlurBehindWindow

imm32

ImmGetDefaultIMEWnd ImmGetContext ImmReleaseContext ImmAssociateContext ImmAssociateContextEx ImmGetCompositionStringW ImmGetOpenStatus ImmNotifyIME ImmSetCompositionWindow ImmSetCandidateWindow ImmGetVirtualKey

setupapi

SetupDiOpenDeviceInterfaceW SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW SetupDiOpenDevRegKey SetupDiDestroyDeviceInfoList

shlwapi

AssocQueryStringW

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

comdlg32

GetSaveFileNameW GetOpenFileNameW

d3d9

Direct3DCreate9

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory2

d3d12

D3D12SerializeVersionedRootSignature ord101 ord102

gdi32

SetTextColor SetGraphicsMode SetBkMode GetCharABCWidthsI GetCharWidthI GetTextExtentPoint32W GetOutlineTextMetricsW GetGlyphOutlineW GetCharABCWidthsFloatW GetCharABCWidthsW GetStockObject GetTextFaceW GetTextMetricsW RemoveFontMemResourceEx AddFontMemResourceEx SetTextAlign AddFontResourceExW GetFontData EnumFontFamiliesExW CreateFontIndirectW GetDIBits SetWorldTransform GetBitmapBits SwapBuffers GetPixelFormat DescribePixelFormat CreateBitmap CreateDCW CreateCompatibleBitmap SetLayout OffsetRgn SetPixelFormat ChoosePixelFormat GetDeviceCaps BitBlt GdiFlush CreateDIBSection SelectObject SelectClipRgn GetRegionData DeleteObject DeleteDC CreateRectRgn CreateCompatibleDC CombineRgn GetObjectW ExtTextOutW RemoveFontResourceExW

uxtheme

GetCurrentThemeName GetThemeTransitionDuration CloseThemeData OpenThemeData ord47 GetThemeBackgroundRegion GetThemePartSize IsThemeBackgroundPartiallyTransparent GetThemeColor GetThemeBool GetThemeInt GetThemeEnumValue GetThemeMargins GetThemePropertyOrigin SetWindowTheme IsThemeActive IsAppThemed

dwrite

DWriteCreateFactory

uiautomationcore

UiaRaiseNotificationEvent UiaRaiseAutomationEvent UiaRaiseAutomationPropertyChangedEvent UiaReturnRawElementProvider UiaClientsAreListening UiaHostProviderFromHwnd

oleaut32

GetErrorInfo SysFreeString VariantInit VariantClear SafeArrayPutElement SysAllocString SetErrorInfo SysStringLen SafeArrayCreateVector

dnsapi

DnsFree DnsQueryEx DnsExtractRecordsFromMessage_W DnsWriteQuestionToBuffer_W

secur32

InitSecurityInterfaceW

winhttp

WinHttpCloseHandle WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpOpen WinHttpGetDefaultProxyConfiguration

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

userenv

GetUserProfileDirectoryW

advapi32

RegQueryValueExW CopySid DuplicateToken GetSidSubAuthority GetSidSubAuthorityCount FreeSid ReportEventW RegisterEventSourceW DeregisterEventSource AddAccessDeniedAceEx AddAccessAllowedAceEx OpenProcessToken AddAccessAllowedAce GetUserNameW LookupAccountNameW RegSetValueExW RegQueryInfoKeyW RegFlushKey RegEnumValueW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW AllocateAndInitializeSid RegOpenKeyExW RegNotifyChangeKeyValue RegCloseKey GetNamedSecurityInfoW LookupAccountSidW SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl InitializeSecurityDescriptor InitializeAcl GetLengthSid GetTokenInformation SystemFunction036

authz

AuthzAccessCheck AuthzInitializeResourceManager AuthzFreeResourceManager AuthzInitializeContextFromToken AuthzInitializeContextFromSid AuthzFreeContext

kernel32

lstrcmpW WTSGetActiveConsoleSessionId GlobalAlloc SleepEx EncodePointer DecodePointer LCMapStringEx GetLocaleInfoEx InitOnceExecuteOnce CreateEventExW WaitNamedPipeW FlushProcessWriteBuffers GetCurrentProcessorNumber FreeLibraryWhenCallbackReturns SetThreadpoolTimer GetStringTypeW GetCPInfo UnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW InitializeSListHead InterlockedPushEntrySList WaitForMultipleObjects DisconnectNamedPipe CreateSemaphoreW CreateSymbolicLinkW CloseThreadpoolTimer CreateSemaphoreExW WaitForThreadpoolTimerCallbacks GlobalSize GlobalUnlock GlobalLock CheckRemoteDebuggerPresent ExpandEnvironmentStringsW GetUserDefaultLocaleName GetUserDefaultLangID InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive CreateThreadpoolTimer ReleaseSemaphore K32GetModuleFileNameExW OpenProcess OpenFileMappingW VirtualQuery FindNextFileW FindFirstFileExW GetUserGeoID GetGeoInfoW GetCurrentPackageFullName GetModuleHandleExW CloseThreadpoolWait WaitForThreadpoolWaitCallbacks SetThreadpoolWait CreateThreadpoolWait CancelIoEx GetOverlappedResult PeekNamedPipe AcquireSRWLockShared WakeAllConditionVariable GetUserPreferredUILanguages GetUserDefaultLCID GetCurrencyFormatW LocaleNameToLCID GetLocaleInfoW GetTimeFormatW GetDateFormatW AttachConsole FreeConsole AllocConsole GetModuleFileNameW SetFilePointerEx SetFileInformationByHandle GetVolumeInformationW WakeConditionVariable QueryPerformanceFrequency TryAcquireSRWLockExclusive ReadConsoleW ReadConsoleA GetFileType GetDriveTypeW GetFileInformationByHandleEx FileTimeToSystemTime TzSpecificLocalTimeToSystemTime MoveFileExW MoveFileW CopyFileW InitializeCriticalSectionEx GetTickCount64 TryAcquireSRWLockShared SleepConditionVariableSRW GetVolumePathNamesForVolumeNameW SetFileTime SetConsoleMode GetConsoleMode GetEnvironmentVariableW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount VirtualFree VirtualAlloc ReleaseMutex InterlockedFlushSList LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetCommandLineA SetStdHandle GetConsoleOutputCP SetFileAttributesW ExitProcess SystemTimeToTzSpecificLocalTime SetConsoleCtrlHandler FlsAlloc FlsGetValue FlsSetValue FlsFree IsThreadAFiber VirtualProtect IsValidLocale EnumSystemLocalesW GetFileSizeEx SetEnvironmentVariableW HeapQueryInformation IsValidCodePage GetOEMCP WriteConsoleW GetSystemDirectoryW FindCloseChangeNotification FindFirstChangeNotificationW FindNextChangeNotification DeviceIoControl GetNamedPipeClientProcessId GetLastError GlobalFree CreateFileW CloseHandle SetUnhandledExceptionFilter SetErrorMode WaitForSingleObject GetCurrentProcess GetCurrentProcessId GetExitCodeProcess GetCurrentThreadId GetProcAddress LoadLibraryW FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime WideCharToMultiByte FreeLibrary SystemTimeToFileTime GetProcessHeap GetFileSize LockFileEx LocalFree CreateFileMappingA UnlockFile HeapDestroy HeapCompact HeapAlloc GetSystemInfo HeapReAlloc DeleteFileW DeleteFileA GetVersionExA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA Sleep MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetVersionExW GetFileAttributesW CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapFree HeapCreate ReadFile AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection TerminateProcess IsProcessorFeaturePresent GetCurrentThread GetModuleHandleW GetConsoleWindow CompareStringEx GetLocalTime GetCommandLineW SwitchToThread SetThreadPriority GetThreadPriority TerminateThread ResumeThread SetThreadInformation SetThreadDescription CompareStringW LCMapStringW GetComputerNameExW GetNativeSystemInfo SetEvent ResetEvent CreateEventW GetStdHandle GetEnvironmentStringsW FreeEnvironmentStringsW SetLastError ConnectNamedPipe CreateNamedPipeW WaitForMultipleObjectsEx CreateProcessW GetProcessId LocalAlloc GetACP GetTimeZoneInformation SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW GetFileInformationByHandle GetLogicalDrives GetLongPathNameW RemoveDirectoryW

netapi32

NetShareEnum NetApiBufferFree

ole32

StringFromGUID2 CoGetMalloc DoDragDrop OleIsCurrentClipboard OleFlushClipboard OleGetClipboard OleSetClipboard CoUninitialize CoInitializeEx RevokeDragDrop CoSetProxyBlanket CoCreateInstance CoTaskMemFree CoCreateGuid OleInitialize OleUninitialize ReleaseStgMedium CoLockObjectExternal RegisterDragDrop CoCreateFreeThreadedMarshaler CoInitializeSecurity

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

winmm

timeKillEvent timeSetEvent PlaySoundW

icuuc

ucnv_fromUnicode ucnv_toUnicode ucnv_setToUCallBack ucnv_getFromUCallBack ucnv_getAvailableName ucnv_getStandardName ucnv_getMaxCharSize ucnv_reset ucnv_close ucnv_setFromUCallBack ucnv_getToUCallBack ucnv_getName ucnv_countAvailable UCNV_FROM_U_CALLBACK_SUBSTITUTE ucnv_cbToUWriteUChars ucnv_open ucnv_cbFromUWriteUChars ucnv_toUCountPending ucnv_fromUCountPending UCNV_TO_U_CALLBACK_SUBSTITUTE

shell32

SHGetKnownFolderPath CommandLineToArgvW ord680 ShellExecuteExW SHCreateItemFromIDList SHCreateItemFromParsingName SHGetFileInfoW ord727 ord6 ShellExecuteW SHGetMalloc SHGetPathFromIDListW SHGetKnownFolderIDList SHBrowseForFolderW Shell_NotifyIconW Shell_NotifyIconGetRect SHGetStockIconInfo

crypt32

CertCloseStore CertFindCertificateInStore CertCreateCertificateContext CertFreeCertificateContext CertAddCertificateContextToStore CertGetCertificateChain CertFreeCertificateChain CertOpenStore

bcrypt

BCryptGenRandom

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

Name

.text

Size

33.6MB

Virtual Size

33.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

18.1MB

Virtual Size

18.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

506KB

Virtual Size

684KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.qtmimed

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

313B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

114KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

310KB

Virtual Size

310KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

КИБЕРЩИТ ／／ XCore.exe

IMPHASH 70df50797f7a85a271c38135c5679c40
SHA256 4fda9d4f7447ef54900b128226e8548d19ea041650555af4697a50390a5e7e75
MD5 0955c7a9b3fca6021d4c7b5f9d8d68c0
SHA1 0300b1f7b0bc0f7ae172ad1bb2ddcff6ddf0b6f4
SHA512 45b32faf086201305e5097b2b453a4ce61c3508f9a48def57d3a52fc2f720a81daa7442148316d0367b05ec65836cc72460f80c4394bd3ca507c193a7c2d56e4
SSDEEP 393216:Pxe3Wy0DVMeE9ZMWiJPbAoX093Y1gY8gEygpbUWtM9rg+0d9D3bao:Pxe3UH1VFi9+gYXNNWZvd
TLSH
T175E72843F86A0CE9C5ADC430D5A295237B717C594B2027E72B60FA147F7ABD0A6FA350
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

604160

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

26.5MB

Virtual Size

26.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

32.9MB

Virtual Size

32.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.5MB

Virtual Size

33.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

780KB

Virtual Size

780KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

646KB

Virtual Size

646KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

kibershield-x-windows-amd64-setup.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/UserInfo.dll

advapi32

kernel32

generic

$PLUGINSDIR/kill_kibershield_processes.ps1

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

AppIcon.ico

LICENSE-KIBERSHIELD-X.txt

libcronet.dll

kernel32

advapi32

dbghelp

ws2_32

shell32

iphlpapi

winmm

shlwapi

ole32

winhttp

user32

secur32

crypt32

api-ms-win-core-winrt-l1-1-0

ntdll

generic

КИБЕРЩИТ ／／ X.exe

wininet

wsock32

ws2_32

user32

rasapi32

iphlpapi

ntdll

dwmapi

imm32

setupapi

shlwapi

wtsapi32

api-ms-win-shcore-scaling-l1-1-1

comdlg32

d3d9

d3d11

dxgi

d3d12

gdi32

uxtheme

dwrite