swift[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
swift.zip
Size 14.9MB
Sample260815-2c2k4avbph
SHA256 bced4bf4912737f69cba975ca1521ffad5e74653684022df5e6171cc60cc094e
MD5 417bd0e0d1470f1cd45d2b1f59990145
SHA1 31debb210d134270356f65efcaede9b590d8a240
SHA512 3863b7fbbff709b81fe1fe6e2061505a0891da1edf67f2e3528f63daab8eb272537a0e10b93683c75718b89a797b8d0e7fa90e8faebc9503ff613b10fd77f54b
SSDEEP 393216:8bVsGesmWzS7WA7+i2U1wyVObve+Rt1o5tlt2SeX9:8bVrepWzgWJ66P+tl4X9
TLSH
T125F63307CAD0322BD5A85476195EC8ADD0FAEE87B50AF7733872CDA3CA453D0855FA21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/bin/injector.exe	themida

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Swift.exe
unpack001/bin/Dll3.dll
unpack001/bin/injector.exe

File Explorer

swift.zip

.zip 14.9MB
Swift.exe

.exe 13.0MB
bin/Dll3.dll

.dll 6.4MB
bin/injector.exe

.exe 3.8MB

swift.zip

SHA256 bced4bf4912737f69cba975ca1521ffad5e74653684022df5e6171cc60cc094e
MD5 417bd0e0d1470f1cd45d2b1f59990145
SHA1 31debb210d134270356f65efcaede9b590d8a240
SHA512 3863b7fbbff709b81fe1fe6e2061505a0891da1edf67f2e3528f63daab8eb272537a0e10b93683c75718b89a797b8d0e7fa90e8faebc9503ff613b10fd77f54b
SSDEEP 393216:8bVsGesmWzS7WA7+i2U1wyVObve+Rt1o5tlt2SeX9:8bVrepWzgWJ66P+tl4X9
TLSH
T125F63307CAD0322BD5A85476195EC8ADD0FAEE87B50AF7733872CDA3CA453D0855FA21
MD5 SHA1 SHA512 SSDEEP TLSH

Swift.exe

IMPHASH 81da7dd5cf11059e6ac0ae2e6001ffff
SHA256 a6392ee4b34c64a366500cb050478049560e6acbb02c20077d38f3d5ee5497d1
MD5 1f22eb0a0742c95cec82a91205411797
SHA1 c36230783fb1039857a99e401ded02158c955360
SHA512 c29201c7ef9a63268731d73511fbeb2f694749677bee45b38fb2b9d9db7dfe382f8bd8e6ad2191379d69ed116f2a6fdbf48cf2c437bae935cfe03a7df131171a
SSDEEP 196608:K2KWwCM6GV/pekczMb5b/bnUMOcvRYKdEL5jKxpw9bWQ:K2KWwCM6eHczMNzzUxmRYKdElevw9qQ
TLSH
T195D67C217B8A99ADC05AC470838647726E3170DB0B35BAFF45D486793FA9AF41F3C258
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5817708

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Swift.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

user32

GetForegroundWindow RegisterTouchWindow GetSystemMetrics RegisterWindowMessageA IsWindow RegisterClassExW SetCapture CreateWindowExW DefWindowProcW ScreenToClient SetCursorPos GetWindowLongW InvalidateRgn CreateIcon RegisterRawInputDevices SendMessageW SetWindowLongW ShowWindow GetSystemMenu EnableMenuItem GetClipCursor ClipCursor ShowCursor GetMenu SetWindowDisplayAffinity GetWindowLongPtrW CheckMenuItem GetWindowRect PostThreadMessageW PeekMessageW MonitorFromRect SetWindowPos AdjustWindowRectEx IsWindowVisible ClientToScreen DispatchMessageW EnumChildWindows MsgWaitForMultipleObjectsEx SetWindowLongPtrW ReleaseCapture GetCursorPos IsIconic GetActiveWindow SetForegroundWindow TrackPopupMenu FlashWindowEx GetRawInputData GetKeyboardLayout SetMenu PostMessageW TrackMouseEvent RegisterClassW GetTouchInputInfo GetClientRect RedrawWindow TranslateMessage GetMessageW GetAncestor SetMenuItemInfoW CreateMenu CreatePopupMenu AppendMenuW PostQuitMessage CreateAcceleratorTableW GetDC IsProcessDPIAware GetKeyboardState DestroyWindow DestroyAcceleratorTable GetAsyncKeyState GetKeyState MapVirtualKeyExW VkKeyScanW ToUnicodeEx DispatchMessageA GetMessageA TranslateAcceleratorW DestroyIcon EnumDisplayMonitors MonitorFromPoint SetWindowTextW GetWindowTextLengthW GetWindowTextW SendInput GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW MapVirtualKeyW GetUpdateRect ValidateRect SetCursor LoadCursorW GetMonitorInfoW MonitorFromWindow CloseTouchInputHandle SystemParametersInfoA

kernel32

SetUnhandledExceptionFilter RtlPcToFileHeader LocalFree ReadProcessMemory HeapAlloc GetProcessIoCounters WaitForSingleObject GetSystemTimes OpenProcess HeapFree RaiseException GetProcessHeap GetExitCodeProcess UnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW GetTempPathW CreateThread WideCharToMultiByte WriteConsoleW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetFullPathNameW ReadFileEx CreateNamedPipeW ExitProcess SetEnvironmentVariableW FormatMessageW EncodePointer CopyFileExW GetFinalPathNameByHandleW RtlUnwindEx CreateMutexA RemoveDirectoryW IsProcessorFeaturePresent VirtualQueryEx GetProcessTimes GetCurrentProcessId K32GetPerformanceInfo GlobalMemoryStatusEx GetSystemInfo ReleaseSemaphore ReadDirectoryChangesW CreateSemaphoreW CreateFileW CancelIo WaitForSingleObjectEx SetThreadErrorMode GetModuleFileNameW DeleteFileW FindFirstFileExW CreateDirectoryW GetFileInformationByHandleEx FindClose DeleteCriticalSection InitializeCriticalSectionAndSpinCount FreeLibrary TlsAlloc ReleaseSRWLockExclusive AcquireSRWLockExclusive FindNextFileW GetModuleHandleA GetNativeSystemInfo ReleaseMutex lstrlenW HeapReAlloc GetUserDefaultLocaleName WakeAllConditionVariable GetSystemTimePreciseAsFileTime LoadLibraryA QueryPerformanceFrequency TerminateProcess GetUserDefaultUILanguage LCIDToLocaleName SleepEx LoadLibraryW WriteFileEx GetStdHandle SetFileInformationByHandle GetCommandLineW GetEnvironmentStringsW GetCurrentDirectoryW SetLastError RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext QueryPerformanceCounter SetWaitableTimer CreateWaitableTimerExW SwitchToThread GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler CompareStringOrdinal FreeEnvironmentStringsW GetConsoleMode TlsFree GetFileInformationByHandle TlsGetValue SleepConditionVariableSRW Sleep SetFileCompletionNotificationModes PostQueuedCompletionStatus GetProcAddress GetLastError LoadLibraryExW GetQueuedCompletionStatusEx CreateIoCompletionPort SetHandleInformation DuplicateHandle GetCurrentProcess GetEnvironmentVariableW TlsSetValue CloseHandle GetCurrentThreadId GetSystemTimeAsFileTime MultiByteToWideChar InitializeSListHead OutputDebugStringW OutputDebugStringA GetFileAttributesW

gdi32

DeleteObject GetDeviceCaps CreateRectRgn

dwmapi

DwmEnableBlurBehindWindow

ole32

CoCreateInstance OleInitialize RegisterDragDrop RevokeDragDrop CoInitializeEx CoTaskMemFree CoTaskMemAlloc CoUninitialize CreateStreamOnHGlobal

comctl32

TaskDialogIndirect SetWindowSubclass DefSubclassProc RemoveWindowSubclass

shell32

CommandLineToArgvW Shell_NotifyIconGetRect Shell_NotifyIconW SHAppBarMessage ShellExecuteW SHGetKnownFolderPath SHCreateItemFromParsingName DragQueryFileW DragFinish

pdh

PdhOpenQueryA PdhCloseQuery PdhRemoveCounter PdhAddEnglishCounterW PdhCollectQueryData PdhGetFormattedCounterValue

powrprof

CallNtPowerInformation

ntdll

NtQuerySystemInformation NtWriteFile RtlNtStatusToDosError NtDeviceIoControlFile NtReadFile NtCreateFile RtlGetVersion NtCancelIoFileEx NtQueryInformationProcess NtOpenFile

advapi32

EventRegister RegQueryValueExW EventSetInformation RegCloseKey EventWriteTransfer EventUnregister RegGetValueW SystemFunction036 OpenProcessToken GetTokenInformation CopySid GetLengthSid IsValidSid RegOpenKeyExW

psapi

GetModuleFileNameExW

oleaut32

GetErrorInfo SysStringLen SysFreeString SetErrorInfo

secur32

ApplyControlToken EncryptMessage AcceptSecurityContext InitializeSecurityContextW FreeContextBuffer DecryptMessage AcquireCredentialsHandleA FreeCredentialsHandle DeleteSecurityContext QueryContextAttributesW

ws2_32

freeaddrinfo getsockname WSACleanup WSAStartup getaddrinfo closesocket WSAGetLastError WSAIoctl setsockopt WSASend send recv shutdown getsockopt ioctlsocket connect bind WSASocketW getpeername

crypt32

CertDuplicateCertificateContext CertFreeCertificateContext CertVerifyCertificateChainPolicy CertGetCertificateChain CertFreeCertificateChain CertCloseStore CertOpenStore CertDuplicateStore CertAddCertificateContextToStore CertEnumCertificatesInStore CertDuplicateCertificateChain

uxtheme

SetWindowTheme

bcrypt

BCryptGenRandom

api-ms-win-crt-string-l1-1-0

wcsncmp strlen wcslen strcpy_s _wcsicmp

api-ms-win-crt-math-l1-1-0

pow trunc round __setusermatherr floor

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode calloc _callnewh

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s

api-ms-win-crt-runtime-l1-1-0

_set_app_type _c_exit _initterm _register_thread_local_exe_atexit_callback _get_initial_narrow_environment abort _cexit __p___argv _exit _crt_atexit _register_onexit_function _initialize_onexit_table __p___argc _seh_filter_exe _configure_narrow_argv _initterm_e exit terminate _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

bin/Dll3.dll

IMPHASH a23beb34f45a26017e200c72a4ef0e08
SHA256 738787ac7f851fbf63ec46d576f23b7aa2e190daf33bf13fbd8354b693a4f437
MD5 04c88b5a60dbb32b960a6706556b47ce
SHA1 6b249ffe516a53a0682412f76a736b11d4e420cf
SHA512 7fe565c2520878c4c2471f66447c8f0bf5727ca9cd1cc88376db72038a301aa4afd2ff3006a98968fc2b727ff6cf679d67d8d1431565b2e045d0a3ade8b32ce2
SSDEEP 98304:NoYJChbWll55iEV/RXFxvBg35fsSsxdo55iPWAMDgTLjRCr:NoYJICd5iEV/RXFxvC3Dsx8V0tCr
TLSH
T16866CF6AA3A411E8C47AC178C5675607F7B2782D0370A7EF23D19B652F23BE1963E701
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2952196

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

VirtualProtect CloseHandle GetLastError CreatePipe SetHandleInformation ReadFile SetUnhandledExceptionFilter FindFirstChangeNotificationA GetCurrentProcessId WriteConsoleW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage DeleteFileW SetEndOfFile SetStdHandle HeapQueryInformation GetSystemInfo GetTimeZoneInformation HeapReAlloc FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetConsoleOutputCP WriteFile ReadConsoleW GetConsoleMode GetModuleFileNameW FindNextChangeNotification FileTimeToSystemTime WakeAllConditionVariable WakeConditionVariable GetCurrentThread Sleep WaitForSingleObject DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualQuery InitializeCriticalSection HeapSize CreateProcessA SystemTimeToTzSpecificLocalTime GetDriveTypeW FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW ExitProcess LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer GetTickCount64 RtlPcToFileHeader TryAcquireSRWLockExclusive GetExitCodeThread GetFileInformationByHandleEx AreFileApisANSI GetTempPathW SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle GetCurrentProcess QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress RtlUnwind QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar SetFilePointerEx SetLastError GetThreadTimes RaiseException SetEvent ResetEvent CreateEventA FormatMessageA ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepEx InitializeCriticalSectionEx GetSystemDirectoryW GetModuleHandleW LoadLibraryW GetEnvironmentVariableA GetTickCount FormatMessageW MoveFileExW VerifyVersionInfoW GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects WaitForSingleObjectEx CreateFileW GetFileSizeEx GetSystemTimeAsFileTime MoveFileExA FindClose FindFirstFileW FindNextFileW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent SleepConditionVariableSRW InitializeSListHead IsDebuggerPresent GetStartupInfoW GetCurrentThreadId LocalFree GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindFirstFileExW GetFileAttributesW GetFileAttributesExW

user32

ClientToScreen GetCapture ScreenToClient LoadCursorA GetMessageExtraInfo GetKeyState MessageBoxA CallNextHookEx UpdateWindow RegisterClassExA FindWindowA PostQuitMessage PeekMessageA GetKeyboardLayout SetLayeredWindowAttributes CreateWindowExA SetWindowLongA SetCapture SetWindowPos DestroyWindow GetWindowRect DispatchMessageA DefWindowProcW SendInput mouse_event MapVirtualKeyA GetSystemMetrics keybd_event GetWindowThreadProcessId TrackMouseEvent TranslateMessage ReleaseCapture SetCursorPos GetCursorPos SetCursor SetClipboardData GetClipboardData EmptyClipboard CloseClipboard IsWindowUnicode GetForegroundWindow GetClientRect ShowWindow OpenClipboard

advapi32

CryptImportKey CryptEncrypt CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW CryptDestroyKey GetCurrentHwProfileA SystemFunction036 CryptDestroyHash

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

setupapi

SetupDiGetDeviceRegistryPropertyA SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetClassDevsA

dbghelp

SymFromAddr StackWalk64 SymFunctionTableAccess64 SymGetModuleBase64 SymInitialize

bcrypt

BCryptGenRandom BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider

shlwapi

PathFindExtensionA

ws2_32

gethostname htonl listen connect __WSAFDIsSet select WSAStartup WSACleanup WSASetLastError WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAWaitForMultipleEvents inet_pton inet_ntop closesocket recv send WSAGetLastError recvfrom ioctlsocket setsockopt socket getaddrinfo freeaddrinfo accept bind getpeername getsockname getsockopt htons ntohs WSAIoctl WSAResetEvent sendto

crypt32

CryptDecodeObjectEx CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFindCertificateInStore PFXImportCertStore CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertFreeCertificateContext CryptStringToBinaryW

Name

.text

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

42KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

133KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

..6

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

469B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

bin/injector.exe

SHA256 5e26a7916cd0e7f46f48cb5cbe6c5e43e550968e976e21710aa8fd1146f0f60f
MD5 827fe21c18af864574c8bb24a783c84c
SHA1 c3909db13487bb37b7ff0ad4da46862da3ca757e
SHA512 59699a40c04de5052a1b8fd7f6968c8303916a46285b0eef1df35a282284add7f793ae3148fd563e292c2c6840678857435959b1830d5aa7759a663d086c688a
SSDEEP 98304:lcY38DhXAFmLTkDaeG9VgXDxX7cs+wAzzDYiGdc+x1umC:lsdXLoueG96zd7cs+wAzzqpomC
TLSH
T1180633033BE7BE27EF986FF3861E712F9152E2CE998A975C5D0D093B244411E08568BD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6848600

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

258KB

Virtual Size

502KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

44KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

1024B

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

14KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

1024B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

1KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

5.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

swift.zip

Swift.exe

api-ms-win-core-synch-l1-2-0

bcryptprimitives

user32

kernel32

gdi32

dwmapi

ole32

comctl32

shell32

pdh

powrprof

ntdll

advapi32

psapi

oleaut32

secur32

ws2_32

crypt32

uxtheme

bcrypt

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic

bin/Dll3.dll

d3d11

kernel32

user32

advapi32

imm32

d3dcompiler_47

dwmapi

setupapi

dbghelp

bcrypt

shlwapi

ws2_32

crypt32

generic

bin/injector.exe

generic