unknownzip.zip
- SHA256 b79bbcbdf89bfd3b3e3f6c0685af0de5e5d0370ec5f7fb854b865e2da7bc7b9a
Overview
overview
8Static
static
3unknownzip.zip
windows10-2004-x64
1unknownzip.zip
windows11-ltsc_2024-x64
1AllService....1.exe
windows10-2004-x64
5AllService....1.exe
windows11-ltsc_2024-x64
8Emulator.exe
windows10-2004-x64
7Emulator.exe
windows11-ltsc_2024-x64
7Emulator.pyc
windows10-2004-x64
3Emulator.pyc
windows11-ltsc_2024-x64
8How to use.txt
windows10-2004-x64
1How to use.txt
windows11-ltsc_2024-x64
1launcher.exe
windows10-2004-x64
5launcher.exe
windows11-ltsc_2024-x64
5mkcert.exe
windows10-2004-x64
1mkcert.exe
windows11-ltsc_2024-x64
8payload.dll
windows10-2004-x64
1payload.dll
windows11-ltsc_2024-x64
1Behavioral task
behavioral1
Sample
unknownzip.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
unknownzip.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
AllServices_module_v2.0.1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral4
Sample
AllServices_module_v2.0.1.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
Behavioral task
behavioral5
Sample
Emulator.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral6
Sample
Emulator.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
900 seconds
Behavioral task
behavioral7
Sample
Emulator.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
900 seconds
Behavioral task
behavioral8
Sample
Emulator.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
900 seconds
Behavioral task
behavioral9
Sample
How to use.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral10
Sample
How to use.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral11
Sample
launcher.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral12
Sample
launcher.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral13
Sample
mkcert.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral14
Sample
mkcert.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral15
Sample
payload.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral16
Sample
payload.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
900 seconds
General
- Target unknownzip.zip
- Size 47.6MB
- Sample260809-w168latcpg
- SHA256 b79bbcbdf89bfd3b3e3f6c0685af0de5e5d0370ec5f7fb854b865e2da7bc7b9a
- MD5 e88b06b7115913fdc712363c8d65b630
- SHA1 2e7c832f6a94cee8e1092c1fa5ad259b15103a3e
- SHA512 57465c477bf7bec41e02f0406244a7f2ae35d9a716d41f9ad8fe71b9d85d46e1f56558f375002afb52cb6d510d5371a1de4ee3d4a8b9333f443d10045e7a85de
- SSDEEP 786432:R+2e8AZsBOq4QCN9jgnXHCrCHpbpw6c4Ieii/MG5BFOQbbK7UmlO3OkHp8aT:R+25A+OZQCN9kIC/w6crt0MG5HHwqT
- TLSH T14FB7331158289AF725E64DFD02C50C0CE8CEBD69379E07856398B73BA99313855C3EBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/Emulator.exe pyinstaller - Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/AllServices_module_v2.0.1.exe unpack001/Emulator.exe unpack001/launcher.exe unpack001/mkcert.exe unpack001/payload.dll
File Explorer
-
unknownzip.zip.zip 47.6MB
-
AllServices_module_v2.0.1.exe.exe 34.1MB
-
Emulator.exe.exe 15.5MB
-
Emulator.pyc8KB
-
How to use.txt93B
-
launcher.exe.exe 237KB
-
mkcert.exe.exe 4.7MB
-
payload.dll.dll 166KB
AllServices_module_v2.0.1.exe
- IMPHASH f642ba11e56e6cda1a75594a2156fef5
- SHA256 1d2fb3885e22a2852b8e18a9337bb1f7de986c19f6f2c5b5067c4ce5023fb041
- MD5 87ed2118ce7591847c9fe270ad690add
- SHA1 3ee345ee8230170aecd66861d44d34344b336f72
- SHA512 0a19f6284142f250dc17d623c01c68598cb0a2800aeeddce9f1a7ef96de9aafbcd20e956411e29ec733ffb1cd588d76920e9c278b6fc798e66b0d235a5495d7d
- SSDEEP 786432:pFqyuMARGZWEGSwRHrSpMbxsRqE4y6fSUxGqB:3qyDAgWvSwRHeCE6fSUxG
- TLSH T10D77239364D453E8C6C34900928E13DA52D1A57E8DDF591D2BC73C026A31EF39A89FBB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
26270840
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
crypt32
CertGetCertificateChain
ws2_32
send
winhttp
WinHttpReceiveResponse
kernel32
GetStdHandle
user32
GetSystemMetrics
gdi32
CreateRoundRectRgn
advapi32
OpenSCManagerA
shell32
ShellExecuteExW
ole32
CoSetProxyBlanket
oleaut32
VariantClear
d3d11
D3D11CreateDeviceAndSwapChain
dwmapi
DwmSetWindowAttribute
winmm
timeEndPeriod
dxgi
CreateDXGIFactory1
imm32
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
ntdll
NtQueryInformationProcess
bcrypt
BCryptHashData
powrprof
CallNtPowerInformation
dbghelp
MiniDumpWriteDump
xinput9_1_0
XInputGetState
setupapi
SetupDiDestroyDeviceInfoList
iphlpapi
GetAdaptersInfo
Name
.text
Size
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
182KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.r;Q
Size
Virtual Size
21.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.?!*
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.%uq
Size
34.0MB
Virtual Size
34.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
140B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Emulator.exe
- IMPHASH d5b1104f7bf955d6b89a47291d5b603b
- SHA256 0540e3b345734176401465ab3fa2dd7667d6e623beaf8925204a4fca94738f36
- MD5 1fce56726e1677d4912b98ab2ad98a31
- SHA1 1adae7b411e79b25bf1cf839692e1d830a651d63
- SHA512 1e463ce33c11254fa3c0fbd5c8ee2b3e184a14e9b782a856f6d57a277fb184de4fdaaa7e026ed1fe747063f37d3c3e80f43f1d6640dc8b31d4ea1d0cc5fa94c2
- SSDEEP 393216:RRfm+I/yr76hdZ+XMCHWUj5zOrPwyLLvkXEyu0Om7A4sC:3mfa7KZ+XMb85zivVml
- TLSH T1AEF6330532B150F2E9F7183941DAC528E67A7C6027A1CACB86EC5B327D674F09F39762
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
54976
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
GetCursorPos
ShutdownBlockReasonCreate
GetWindowThreadProcessId
SetWindowLongPtrW
GetWindowLongPtrW
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
GetMonitorInfoW
MonitorFromPoint
GetSystemMetrics
kernel32
GetTimeZoneInformation
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
HeapSize
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
GetConsoleWindow
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
HeapReAlloc
WriteConsoleW
SetEndOfFile
DeleteFileW
RtlUnwindEx
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetModuleHandleW
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
IsProcessorFeaturePresent
HeapFree
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
GetCurrentDirectoryW
VirtualProtect
CompareStringW
LCMapStringW
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
183KB
Virtual Size
182KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=182, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=7, id=257, version=33145,
count=140, id=1, productName=Unmarked objects,
count=29, id=260, version=36246,
count=1, id=258, version=36246,
Emulator.pyc
- SHA256 b88b44dfcc911afa844722a2593387b53e1ae65fe6ec18a93d2d422855e3ab03
- MD5 06b2113e57a3d9171d1aeac4c8f1d60d
- SHA1 917804ef18d4d921f881dc192c0566269dc884bd
- SHA512 8cb0be08e2a064aa6dde1e2a5a8b3a113d7df3e783538dd1084e538e1495499f80441a4ffac778832d94150a26f28741dfd191e35fa34a82a50bdb70d81342fb
- SSDEEP 192:CFYM6O9wGBP2dKiNM++UX6q0tfPGrfl3kYRS3wik73KCP1W8J:Cuw9w22dKiy++UKBsN3VUgik73KCt9J
- TLSH T141020782B59B82B9FC85F372A0772F686B5042D0B5D28748FEE65CD00CA37708EA515B
- MD5 SHA1 SHA512 SSDEEP TLSH
How to use.txt
- SHA256 db05915058ce0060d975268da3e87c4e45952ccecd016f0c42bdeb2406e125c4
- MD5 2de55eca84f69b7511e2095b75babff3
- SHA1 179c0ccf90f87e3725e2b124495420440d50de8a
- SHA512 c2283467bbaf09d5efaa8df411128be3d037667b81f8b3e7021f4f9bdb4c9ad9feb38cc7e105ceffac10acf98b392e28c9a73e24483830a075b9641fd5a2a95f
- TLSH T156B0126F16D123332C0006140ACF42668001110D0CD7631020428368700894AA5C00D5
- MD5 SHA1 SHA512 TLSH
launcher.exe
- IMPHASH 911e147933b3eedffa9fc95e77461088
- SHA256 14663e375d5e067e9ec18643926d9c9a38c4e9ec7abc7bde651c0d2a269cbbc4
- MD5 7b6dc47609df02c44422f05f5b0879ad
- SHA1 2454c8034c9ea6b0d8845e5ce71acdb91d610c8d
- SHA512 c7520512c7be7216f8db1f6a03c9496bfa48cf347affe3739af6d0cb8daf60799d0d9ce8c202aca93d273765dc2aed493638307d0ec1a9b720415b6e515bbaeb
- SSDEEP 3072:YiW9fG/DPZaWbtwEoKoEH5JmSKKxph0LR/hSMXlk4ZqKFya5XB67TTtz7RMFyLnu:hW9MsK/730Szph0lhSMXlBXBWnx7RMU
- TLSH T14A34AF12F7A6DCF9E60886B588570B44EB337C808382E7CF175499925F679D25F3BA02
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
69592
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
E:\VIRUS\crakcentral\AllServices_module_v2.0.1_allservices\work\payload\x64\Release\launch.pdb
kernel32
WriteProcessMemory
GetEnvironmentVariableA
WaitForSingleObject
ResumeThread
LoadLibraryA
VirtualAllocEx
CreateRemoteThread
CreateProcessA
MultiByteToWideChar
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetModuleHandleW
GetLastError
msvcp140
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?good@ios_base@std@@QEBA_NXZ
??Bios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?id@?$numpunct@D@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPEBD@Z
?_Id_cnt@id@locale@std@@0HA
?_Xbad_alloc@std@@YAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exceptions@std@@YAHXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__C_specific_handler
__std_exception_destroy
__std_exception_copy
__current_exception
__std_terminate
memcpy
memmove
__current_exception_context
memset
api-ms-win-crt-runtime-l1-1-0
_errno
terminate
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
_seh_filter_exe
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
exit
api-ms-win-crt-stdio-l1-1-0
_get_stream_buffer_pointers
_fseeki64
fread
fsetpos
ungetc
setvbuf
fgetpos
__p__commode
fwrite
fgetc
fclose
fflush
_fwrite_nolock
__acrt_iob_func
fputc
_set_fmode
api-ms-win-crt-heap-l1-1-0
malloc
free
_set_new_mode
_callnewh
calloc
api-ms-win-crt-math-l1-1-0
_fdsign
_ldsign
_dsign
__setusermatherr
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-string-l1-1-0
strlen
Name
.text
Size
67KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
162KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=35403,
count=10, id=260, version=35403,
count=32, id=261, version=35403,
count=6, id=257, version=35403,
count=3, id=257, version=33145,
count=188, id=1, productName=Unmarked objects,
count=1, id=265, version=35724,
count=1, id=255, version=35724,
count=1, id=258, version=35724,
mkcert.exe
- IMPHASH 9cbefe68f395e67356e2a5d8d1b285c0
- SHA256 d2660b50a9ed59eada480750561c96abc2ed4c9a38c6a24d93e30e0977631398
- MD5 8ae03fb0741d036801add750b5528acd
- SHA1 4333e9a5b314f2395074ad16d76c30921902c60e
- SHA512 e7e17f3fd77daa704f88ff4dc6a22795ce0dc18b5db980bb2e5dbe823ca84f54ee8bd81e5e3d816668e4a841e53cb2bd487939e6ad805f5866926d6ddfdff086
- SSDEEP 49152:TGzxo43OrdQqXrb/TRvO90dL3BmAFd4A64nsfJnTTx5hFBL+bwmUZ5EygKZlbjIs:A3OO/JLxEclEk3nTsFk+Mm/MN
- TLSH T1DB368D03FC9590E4C5EAE1308A75D292BA717C884B3137D32B14BBBA2E76BD45E78354
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
400512
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
WriteFile
WriteConsoleW
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
PostQueuedCompletionStatus
LoadLibraryA
LoadLibraryW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetEnvironmentStringsW
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
189KB
Virtual Size
595KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
/4
Size
512B
Virtual Size
295B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
278KB
Virtual Size
277KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/32
Size
52KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/46
Size
512B
Virtual Size
63B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/65
Size
457KB
Virtual Size
457KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/78
Size
351KB
Virtual Size
351KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/90
Size
94KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
197KB
Virtual Size
197KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
payload.dll
- IMPHASH b7fc38be6188ff181521d45207c885a7
- SHA256 3623c9f52b5915747e31f3bae7b3480e764bd57cc26f42d4fbaf0f3b8b7b0a8f
- MD5 08217e9e638bc77f0c31dd231022f195
- SHA1 e7139169b21a6f6e3bfde97d20b38dd6aa71abbb
- SHA512 da3e4f78b45409b95a494e468d7dccb8ed2aa4addd7fe0b678b88eb4c8c2e92fdaeb85a6bf105c9cf0d71f72fcbc26e4a84cf68515de7d06c69bf499cd0a350a
- SSDEEP 3072:UR7C6goA5oF1fTh3Fg0gIGZuVtFPLKSCgcDea:CCb5onr000aFj3a
- TLSH T164F37D16F6BA407FE9678534C9530905EB727C835790AAEF53900AF65F2B7D08A3E720
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
17388
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\VIRUS\crakcentral\AllServices_module_v2.0.1_allservices\work\payload\x64\Release\payload.pdb
kernel32
VirtualProtect
GetCurrentProcess
GetModuleHandleA
DisableThreadLibraryCalls
CreateThread
GetProcAddress
FlushInstructionCache
WriteConsoleW
CreateFileW
CloseHandle
HeapCreate
HeapAlloc
HeapReAlloc
HeapFree
Sleep
GetCurrentProcessId
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
GetModuleHandleW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualQuery
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetModuleFileNameW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryExW
LCMapStringW
GetProcessHeap
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
user32
MessageBoxW
shell32
ShellExecuteA
Name
.text
Size
98KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
55KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=137, id=261, version=33145,
count=12, id=260, version=33145,
count=7, id=259, version=33145,
count=10, id=259, version=35403,
count=14, id=260, version=35403,
count=36, id=261, version=35403,
count=4, id=260, version=35223,
count=7, id=257, version=33145,
count=108, id=1, productName=Unmarked objects,
count=1, id=265, version=35724,
count=1, id=255, version=35724,
count=1, id=258, version=35724,