inj[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
inj.zip
Size 616KB
Sample260831-1dn6qaae22
SHA256 d4c1eb927a76788a4c35dfd8e35bb70d3dd046968f293d97fc960685a654982c
MD5 444fcbc62221d71335ef8c418302d2fe
SHA1 26d4d215dbb7adb25d75cffd2fc5b8b4f45e9994
SHA512 133af57f8e488f659faac57b7b7e34e3918ed1c0d4f39f9034cd4991ec9de97b57e7679ca6c8bebba91eb0ecd6db6f119c29e91cd35a5c8ff7fa47292822773b
SSDEEP 12288:weSGDlXg0KTydDzoTYPbb2RrYmgjaE8oUxfj6G/b7Z4I0ydU9Cn6tW:we/Dmou8b2RrvguLj/b7D0uU93tW
TLSH
T150D423638281ABB68FD992B0ABFF21D5B09EC12CD201D2D743CDC3466B14D197A2597F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/inj/Custome DLLS/r6-internal-example.dll
unpack001/inj/dsa123xsa.exe

File Explorer

inj.zip

.zip 616KB
inj/Custome DLLS/r6-internal-example.dll

.dll 956KB
inj/dsa123xsa.exe

.exe 485KB

inj.zip

SHA256 d4c1eb927a76788a4c35dfd8e35bb70d3dd046968f293d97fc960685a654982c
MD5 444fcbc62221d71335ef8c418302d2fe
SHA1 26d4d215dbb7adb25d75cffd2fc5b8b4f45e9994
SHA512 133af57f8e488f659faac57b7b7e34e3918ed1c0d4f39f9034cd4991ec9de97b57e7679ca6c8bebba91eb0ecd6db6f119c29e91cd35a5c8ff7fa47292822773b
SSDEEP 12288:weSGDlXg0KTydDzoTYPbb2RrYmgjaE8oUxfj6G/b7Z4I0ydU9Cn6tW:we/Dmou8b2RrvguLj/b7D0uU93tW
TLSH
T150D423638281ABB68FD992B0ABFF21D5B09EC12CD201D2D743CDC3466B14D197A2597F
MD5 SHA1 SHA512 SSDEEP TLSH

inj/Custome DLLS/r6-internal-example.dll

IMPHASH 20a868c77626b4b92ebb168e09604062
SHA256 c1af86e274dba6114a4ff54aa3d6d38e0e428afdfe41cc20c23c77bf2f8494f6
MD5 fdc8bd46287ad5d4104163298f57191e
SHA1 cc6e7978b2f4b33db4c77e20beed745eac149475
SHA512 a25a87bbf1f1dfde2e5a619793830f23421cfb2638d113e141476557ed6cbdf40ac5214443a9ba6b43529d624af7cca595c17b88fdda74b2fcbb674ee52e2c4c
SSDEEP 24576:n5ROFgKOGR7JcTjbe9nes3qgSIhgxbkFTRhQgkvu4i5jC:i6KTJcTjb8nx3/CkFTRhQgkvu4i5jC
TLSH
T13D257CB2EE02B2DAD43564364497230B97B5B5685B00CBD352D8192DFF437A82DB32DB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

355116

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

FreeLibraryAndExitThread OutputDebugStringA CreateThread AllocConsole SetConsoleTitleA GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte GetModuleHandleA GetProcAddress LoadLibraryA QueryPerformanceCounter QueryPerformanceFrequency GetModuleHandleW GetTickCount64 IsBadReadPtr VirtualProtect GetSystemTimeAsFileTime TerminateProcess IsProcessorFeaturePresent VirtualAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive VirtualFree OpenThread SetThreadContext FlushInstructionCache GetCurrentProcessId GetThreadContext HeapAlloc HeapReAlloc CreateToolhelp32Snapshot ResumeThread SuspendThread GetCurrentThreadId Thread32First Thread32Next GetCurrentProcess HeapFree HeapCreate GetSystemInfo Sleep Beep GetModuleHandleExA VirtualQuery GetModuleFileNameA CreateEventW CloseHandle WaitForSingleObject SetUnhandledExceptionFilter InitializeSListHead

user32

ReleaseCapture GetAsyncKeyState DefWindowProcW UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow LoadCursorW ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow SetCapture GetCapture GetKeyState CallWindowProcW SetWindowLongPtrW OpenClipboard CloseClipboard SetClipboardData IsChild GetClipboardData EmptyClipboard

msvcp140

?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??Bios_base@std@@QEBA_NXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$ctype@D@std@@2V0locale@2@A _Query_perf_counter _Query_perf_frequency _Mtx_lock _Mtx_unlock ?_Throw_Cpp_error@std@@YAXH@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z

d3dcompiler_47

D3DCompile

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext

vcruntime140

memcpy __C_specific_handler memset strrchr __std_type_info_destroy_list __std_exception_copy __current_exception_context __current_exception __C_specific_handler_noexcept memcmp memchr strstr memmove __std_terminate __std_exception_destroy _CxxThrowException

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

terminate _initterm _initterm_e _configure_narrow_argv _invoke_watson _initialize_narrow_environment _crt_atexit _cexit _initialize_onexit_table _execute_onexit_table _register_onexit_function _seh_filter_dll

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func fopen_s fflush __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf fwrite ftell fseek fread fclose _wfopen freopen_s

api-ms-win-crt-heap-l1-1-0

realloc free calloc _callnewh malloc

api-ms-win-crt-string-l1-1-0

_wcsicmp strlen strncpy strcmp strcat_s

api-ms-win-crt-convert-l1-1-0

atof strtoul

api-ms-win-crt-math-l1-1-0

logf pow powf _fdclass log ceilf acosf sqrtf sinf cosf fmodf atan2f

api-ms-win-crt-utility-l1-1-0

qsort

inj/dsa123xsa.exe

IMPHASH cfa6a6d5c51db2c509c58e8fafdda21f
SHA256 c7a593ae87aca3fb6caf300b6bc1b2e01d70e0a41fb635da781c3dd51f679f51
MD5 34702da3dc337236936bceb95db40db5
SHA1 b90867217e58d253e4c5f4c6540247435c61594d
SHA512 a283aa6b7b2f99ce9d32724ba736ed8dd0bb0e654648f6b070037bacba89a27aa82f21eff0785af3af4aabde08733d9777fda1e16ef9d2574803da8bcc7d4ef7
SSDEEP 6144:qLHTA28BHHzs7HtI4V6CtMtDpXuOJIIRXkrbbrDehZm9yzi+LcI/pJT+RiZws:75BHTF/XTziocoT+R
TLSH
T1BAB43A2552891EE8E07685F4AE967503F572380803719AFB47B49991DFE3290BF7BB03
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

336932

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCurrentThread GetExitCodeThread GetThreadContext FlushInstructionCache OpenProcess GetSystemTimeAsFileTime GetTickCount GetTickCount64 VirtualProtect VirtualQuery GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetProcAddress GetComputerNameA MultiByteToWideChar WideCharToMultiByte AllocConsole FreeConsole ReadConsoleInputW WriteConsoleA FlushConsoleInputBuffer SetConsoleTextAttribute SetConsoleTitleA CreateToolhelp32Snapshot Process32FirstW TerminateProcess Thread32First Thread32Next GetTempPathA SetPriorityClass GetSystemInfo GetLocalTime VirtualQueryEx ReadProcessMemory MapViewOfFile GetModuleHandleW OpenFileMappingA GetConsoleWindow GetCurrentThreadId QueryPerformanceCounter GetStartupInfoW SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext CreateThread GetCurrentProcess InitializeSListHead GetCurrentProcessId Sleep CreateEventW WaitForSingleObject SetEvent DeviceIoControl SetLastError GetLastError CloseHandle Beep CheckRemoteDebuggerPresent OutputDebugStringA IsDebuggerPresent GetVolumeInformationA GetTempPathW SetFileAttributesA WriteFile ReadFile GetFileSize FindNextFileW FindFirstFileW FindClose DeleteFileW DeleteFileA CreateFileW CreateFileA CreateDirectoryA GetEnvironmentVariableA Process32NextW GetStdHandle

user32

RegisterClassExA wsprintfW GetMessageW TranslateMessage DispatchMessageW PeekMessageW SendMessageW PostMessageW DefWindowProcW GetWindowTextA SetWindowTextW RedrawWindow InvalidateRect SetWindowRgn EndPaint BeginPaint UpdateWindow DrawTextW GetSystemMetrics EnableWindow KillTimer SetTimer SetFocus IsWindowVisible SetWindowPos PostQuitMessage CallWindowProcW MoveWindow RegisterClassW CreateWindowExW FindWindowA GetParent SetWindowLongPtrW FillRect ScreenToClient MessageBoxW GetWindowRect GetClientRect GetWindowTextW EnumWindows GetWindowThreadProcessId LoadCursorW TrackMouseEvent DefWindowProcA GetClassNameA SetWindowLongW DestroyWindow ShowWindow UnregisterClassA CreateWindowExA IsWindow UpdateLayeredWindow BringWindowToTop GetAsyncKeyState SendInput SetCapture ReleaseCapture GetForegroundWindow GetDC ReleaseDC MessageBoxA GetCursorPos GetWindowLongW

advapi32

GetUserNameA RegCreateKeyW RegCreateKeyExA RegDeleteValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA RegSetKeyValueW RegDeleteTreeW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW RegCloseKey

ntdll

NtUnloadDriver NtLoadDriver RtlAdjustPrivilege RtlInitUnicodeString

gdiplus

GdipGetPropertyItem GdipGetPropertyItemSize GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetTextRenderingHint GdipDrawRectangleI GdipFillRectangleI GdipDrawImageRectRectI GdipFillPolygon GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipCloneImage GdipLoadImageFromFileICM GdipLoadImageFromFile GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipSetClipRectI GdipFillEllipse GdipCreateStringFormat GdipImageSelectActiveFrame GdipMeasureString GdipDrawImageRectI GdipDrawString GdipDeleteFont GdipCreateFont GdipResetClip GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipGetGenericFontFamilySansSerif GdipDeleteStringFormat GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags

gdi32

CreatePen CreateRoundRectRgn CreateSolidBrush DeleteObject Ellipse GetStockObject RoundRect SelectObject SetBkColor SetBkMode SetTextColor CreateCompatibleDC DeleteDC CreateDIBSection CreateFontW

msvcp140

_Thrd_detach ?id@?$ctype@D@std@@2V0locale@2@A ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit ?uncaught_exception@std@@YA_NXZ ?_Xbad_alloc@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z

winhttp

WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpSetTimeouts WinHttpConnect WinHttpAddRequestHeaders WinHttpReceiveResponse WinHttpSendRequest

iphlpapi

GetAdaptersInfo

bcrypt

BCryptOpenAlgorithmProvider BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptCreateHash BCryptCloseAlgorithmProvider BCryptGenRandom

winmm

timeEndPeriod timeBeginPeriod

vcruntime140

strrchr __std_terminate strstr __std_exception_copy __std_exception_destroy _CxxThrowException memcmp memcpy memmove memset strchr __current_exception __current_exception_context __C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _beginthreadex terminate _exit exit _initterm_e _initterm _get_narrow_winmain_command_line _seh_filter_exe _invoke_watson _set_app_type system

api-ms-win-crt-string-l1-1-0

strcat_s _stricmp strcmp strcpy_s _wcsicmp toupper strncmp strncpy_s strlen wcslen wcscat_s wcscpy_s wcsncpy

api-ms-win-crt-stdio-l1-1-0

fopen_s __p__commode freopen_s fopen __stdio_common_vsprintf_s __stdio_common_vsprintf __acrt_iob_func __stdio_common_vswprintf_s _get_stream_buffer_pointers fclose fflush fgetc fgetpos fgets fputc fread freopen fsetpos _fseeki64 fwrite setvbuf __stdio_common_vfprintf _set_fmode __stdio_common_vswprintf ungetc

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-convert-l1-1-0

strtoul atoi mbstowcs

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

fmaxf __setusermatherr _fdclass atan2f ceilf cosf fmodf sinf sqrtf fminf

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode free _callnewh

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

inj.zip

inj/Custome DLLS/r6-internal-example.dll

kernel32

user32

msvcp140

d3dcompiler_47

imm32

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

generic

inj/dsa123xsa.exe

kernel32

user32

advapi32

ntdll

gdiplus

gdi32

msvcp140

winhttp

iphlpapi

bcrypt

winmm

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic