adb.zip
- SHA256 1179d1e005587279ac26c271773f7b35914c759518fa7a7f9c4646a02e644dbc
Behavioral task
behavioral1
Sample
adb/AdbWinApi.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
adb/AdbWinApi.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
adb/UAC.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
adb/UAC.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
adb/adb.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target adb.zip
- Size 1.7MB
- Sample260919-s8elrssgke
- SHA256 1179d1e005587279ac26c271773f7b35914c759518fa7a7f9c4646a02e644dbc
- MD5 5141749a8b6ace439d467d06f0dc1da3
- SHA1 c654fa5516bfe76e8f46a255ef165c62a85eb712
- SHA512 1bea6ca5d7cdb28a5d4c96a88a70b7c5c895dd02102342ba2d6cfdd7b82e61f2784dd07ff786c51f5d928af0bf0977b3e03484f377a4e991d20afa2dcf519280
- SSDEEP 49152:AleZAZNK+hrLhAdiSYs+u4vB2bhEOZt7MGhPsh+:AllZN/h/Dsp4p2bhxZOYK+
- TLSH T15685330EB1EEDC44A01C69119486CD2FE241357D2AF70FE9F45A3E1B2E035E532B9AB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Revoked Certificate in Chain 1 IoCs
One or more certificates in the signing chain have been revoked, indicating potential compromise.
resource unpack001/adb/AdbWinApi.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/adb/UAC.TMP - Untrusted Codesign Signers 2 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/adb/AdbWinApi.dll unpack001/adb/adb.exe
File Explorer
-
adb.zip.zip 1.7MB
-
adb/AdbWinApi.dat148KB
-
adb/AdbWinApi.dll.dll 41KB
-
adb/AdbWinApi.hlp17.1MB
-
adb/UAC.TMP.dll 47KB
-
adb/adb.exe.exe 804KB
-
adb/adb.hlp192KB
-
adb/boot.cfg5KB
adb/AdbWinApi.dat
- SHA256 88045766007380b99fa7874c633d66bcb17d3314b6145ad5f8d8216e8e24b375
- MD5 cbcc0845497ddd773399e0f095539a4c
- SHA1 6c878e4ee18d14b94a3214bdd283b221a1981877
- SHA512 e9a237e1ed9a53ce52c52ed40c43073430bc54b36996c53a90ab7524c0e3a3c9d8fa403b4f0ee52997f19d4d720f7d9db8efa7e988ca53efc221573a05a8e38f
- SSDEEP 3072:ih3sDG9Iicvf9/NBcTTCD2jxuWbDaNlhRlFq6jWevWkt:ih30G9I9f9/NBcf5xbIgU
- TLSH T1B8E3129B33024D40A6CC707AE48BEC6357485BFE3D36275BA1AA32135A008F5706B777
- MD5 SHA1 SHA512 SSDEEP TLSH
adb/AdbWinApi.dll
- IMPHASH 2163308c24bbf0c8c0f9bca066dc8e6e
- SHA256 35311bb7becba40d1fd99414cc1d14db837630e3ea13804442698b777476fe76
- MD5 2e4dce8fec941a97d41dafd9654a3ec5
- SHA1 ac8137b5e2bfc870115d60a476a829c144af359c
- SHA512 9d6415125e2a9e4cb24ee8b0bbf19563005dfe6fbd91e3f4bf0e2bd53d69257e67264483df487352751eb094a200fa92c1254a5ab33e706f7395b1077c92204c
- SSDEEP 768:MFQyPghaQeITkhhWBmnTED5bLyR6ENAMxl2:M9SeIIhlPBxl
- TLSH T169135C1276919877E16B193524F896324D7B3D426AF040CB3BA902BA5FB17C0EA7C367
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Revoked Certificate in Chain
One or more certificates in the signing chain have been revoked, indicating potential compromise.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
c2:a8:4a:05:94:1e:a2:e5:a6:ba:88:cf:41:1a:8f:bd:59:f5:a0:84
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=深圳市创想天空科技股份有限公司,OU=R&D Dept.,O=深圳市创想天空科技股份有限公司,L=深圳市,ST=广东省,C=CN
Chains
May 26, 2024
CN=深圳市创想天空科技股份有限公司,OU=R&D Dept.,O=深圳市创想天空科技股份有限公司,L=深圳市,ST=广东省,C=CN
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=深圳市创想天空科技股份有限公司,OU=R&D Dept.,O=深圳市创想天空科技股份有限公司,L=深圳市,ST=广东省,C=CN
Serial Number
0d:b7:71:51:2a:c4:7c:37:e2:d0:f5:25:81:77:f8:ae
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Revoked
Revocation Date
Jul 12, 2022
Timespan
Jul 12, 2022 - Aug 14, 2024
Minor OS version
1
Major OS version
5
Entry point
5113
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
Sleep
ReadFile
GetModuleFileNameW
CreateFileW
VirtualAlloc
DisableThreadLibraryCalls
GetModuleHandleA
VirtualProtect
CloseHandle
lstrcpyW
GetCurrentThreadId
DecodePointer
GetCommandLineA
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
GetLastError
InterlockedDecrement
GetProcAddress
HeapFree
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
HeapReAlloc
LoadLibraryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
WriteFile
RtlUnwind
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapSize
IsProcessorFeaturePresent
AdbCloseHandle
AdbCreateInterfaceByName
AdbEnumInterfaces
AdbGetEndpointInformation
AdbGetInterfaceName
AdbGetSerialNumber
AdbGetUsbDeviceDescriptor
AdbGetUsbInterfaceDescriptor
AdbNextInterface
AdbOpenDefaultBulkReadEndpoint
AdbOpenDefaultBulkWriteEndpoint
AdbReadEndpointSync
AdbWriteEndpointSync
Name
.text
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=171, productName=VS2010 build 30319, version=30319,
count=8, id=158, productName=VS2010 build 30319, version=30319,
count=55, id=170, productName=VS2010 build 30319, version=30319,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=69, id=1, productName=Unmarked objects,
count=3, id=175, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
adb/AdbWinApi.hlp
- SHA256 1e67b45b381012827b21ba5e450354c7e45ec1452d6904147fac0ee1d1544f1a
- MD5 aad93058e8fe3044f6dd3838a431db3f
- SHA1 68fda11b5e19730e0f81d37482e704f165804318
- SHA512 7101925923c6bb7d51ae4968e5e692bf488223eee03919f550e8e3cfd676c6d211b41d6cc373c3a0b1dc0f15c2bba46e9f09af6b7bb38b95e3753c8d295f3306
- SSDEEP 12288:XOmtmXQ4BdavXfNsWs1AsdOAFwK6rtlwQ9tQknXS3tj4zpT5sws7s6YDDw9:sb9um
- TLSH T114079E2F216DC71AE0F8C705D0E9096E9636684AE9759F0C13E5528851EB80379B2FFF
- MD5 SHA1 SHA512 SSDEEP TLSH
adb/UAC.TMP
- IMPHASH 3888d2ac36d71a900919dd53798a47ab
- SHA256 b3d819160421011c002e1c4bd2621b15566134937e700697258eba954de5836b
- MD5 f4da06097e704faf47daa63ccf073793
- SHA1 e7ce70b70947b99436ad6c0f9b573f090da8bb1d
- SHA512 c363175ffc61aa3a659be663d1b7a53678cfe24b4318568024648e721fe9bb25c2742d18b539ea6c4fd60d65e9a567b2226dc6e3cf5656016df1d0a5f7b8e214
- SSDEEP 768:H7VX11fhqL6cnbf1b/kIqjrBwoRn1A0Xm8zb0uhcsx3PkJmnjEDkmR12+:JLfhqO0LdMXrBwol+OTzwiJx3Phu2
- TLSH T13F2339527290C032E197293458A5D3326A3F7C326AF8848B7F9512F95FB07E0F639366
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
5844
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCommandLineW
CreateProcessW
GetCurrentProcess
WaitForSingleObject
TerminateProcess
GetModuleFileNameW
GetLastError
GetProcAddress
LoadLibraryA
CloseHandle
lstrcpyW
FlushFileBuffers
CreateFileW
HeapSize
IsProcessorFeaturePresent
GetStringTypeW
LCMapStringW
WriteConsoleW
GetCurrentThreadId
DecodePointer
GetCommandLineA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
InterlockedDecrement
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
HeapAlloc
HeapReAlloc
LoadLibraryW
RtlUnwind
SetStdHandle
shell32
CommandLineToArgvW
ole32
StringFromGUID2
CoInitialize
IIDFromString
CoGetObject
CLSIDFromString
shlwapi
PathFindFileNameW
BypassUAC
Name
.text
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=152, version=20115,
count=26, id=171, productName=VS2010 build 30319, version=30319,
count=14, id=158, productName=VS2010 build 30319, version=30319,
count=88, id=170, productName=VS2010 build 30319, version=30319,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=85, id=1, productName=Unmarked objects,
count=4, id=175, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
adb/adb.exe
- IMPHASH 879e62881b452fa51161345afb04a6de
- SHA256 ef4c7f4c417c18cd3394dd81ccd94381af252e0af81b0ad89b7e6d81412f4706
- MD5 790fb1184a3ed8e475263daa54f98469
- SHA1 37a60f670a4f3c68a4872ec2e95c0be2bd130dae
- SHA512 66a2325c59a7fdacd049f43b528224682245c2705f10c50a907b6454d5755522b9d9d07046426d42db8c324ba95adbde1de087e31a0fb21b635c1dc4ca25a4f8
- SSDEEP 12288:CMLitTtq+E3vEtR1PcUjB2ZuTvD5lnT7SQ22v9dzW74hGO2fVpUGpZdT3Rr8tz:CP5mC1P1jB2kv1xf9M4cThr8tz
- TLSH T122056D13A411D8F7F83201F21755EBB01662C6321153DCA276E9E82DAF72E52BE6933D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
94:9f:f5:b9:29:5c:f3:ff:7c:15:d6:f8:c6:ec:21:31:ed:ce:f1:34
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN
Chains
Apr 18, 2014
CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN
Subject
CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 10, 2010 - May 10, 2015
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto
Timespan
Nov 8, 2006 - Nov 7, 2021
Subject
CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN
Serial Number
51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 11, 2013 - Mar 10, 2016
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
0
Major OS version
4
Entry point
4400
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
DeregisterEventSource
RegisterEventSourceA
ReportEventA
gdi32
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCA
DeleteDC
DeleteObject
GetBitmapBits
GetDeviceCaps
GetObjectA
SelectObject
kernel32
CloseHandle
CreateEventA
CreateFileA
CreatePipe
CreateProcessA
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FreeLibrary
GetCurrentProcessId
GetCurrentThreadId
GetFileAttributesA
GetFileSize
GetFileType
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStdHandle
GetSystemTimeAsFileTime
GetTempPathA
GetTickCount
GetVersion
GetVersionExA
GlobalMemoryStatus
InitializeCriticalSection
InterlockedCompareExchange
InterlockedExchange
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
QueryPerformanceCounter
ReadFile
ResetEvent
SetConsoleCtrlHandler
SetEvent
SetFilePointer
SetHandleInformation
SetLastError
SetUnhandledExceptionFilter
Sleep
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
msvcrt
_access
_chmod
_getcwd
_getpid
_read
_stat
_strdup
_stricmp
_umask
_unlink
__getmainargs
__lc_codepage
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_beginthread
_beginthreadex
_cexit
_endthreadex
_errno
_exit
_findclose
_findfirst
_findnext
_fullpath
_getch
_iob
_isctype
_mkdir
_onexit
_pctype
_setmode
_stricmp
_strnicmp
_vsnprintf
_wfopen
abort
atexit
atoi
calloc
exit
fclose
fflush
fgets
fopen
fprintf
fputc
fputs
fread
free
fseek
ftell
fwrite
getenv
gmtime
localeconv
localtime
malloc
memchr
memcpy
memmove
memset
perror
qsort
raise
realloc
setvbuf
signal
sscanf
strcat
strchr
strcmp
strcpy
strerror
strlen
strncat
strncmp
strncpy
strpbrk
strrchr
strtol
strtoul
time
tolower
vfprintf
wcslen
wcsstr
shell32
SHGetFolderPathA
user32
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
ws2_32
WSACleanup
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAStartup
accept
bind
closesocket
connect
gethostbyname
htonl
htons
listen
recv
send
setsockopt
shutdown
socket
adbwinapi
AdbCloseHandle
AdbCreateInterfaceByName
AdbEnumInterfaces
AdbGetEndpointInformation
AdbGetInterfaceName
AdbGetSerialNumber
AdbGetUsbDeviceDescriptor
AdbGetUsbInterfaceDescriptor
AdbNextInterface
AdbOpenDefaultBulkReadEndpoint
AdbOpenDefaultBulkWriteEndpoint
AdbReadEndpointSync
AdbWriteEndpointSync
Name
.text
Size
615KB
Virtual Size
614KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
169KB
Virtual Size
169KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
adb/adb.hlp
- SHA256 af646b2cbcf09e09df23e91d7164dbaf331d3729a008503126bf40803034e502
- MD5 65d95d31fb69c233bf698ec6242df6e9
- SHA1 1e72f350d49ea8d467ff4b53ce9f6e456869b196
- SHA512 31106d5f4bc84a7628fc15f941f4d305514b7b4d3dd685e5825b135de2cb4adfb19a5cede13419199468dd200c7373c9a2a5572adeebe14353982245c95579f2
- SSDEEP 1536:3ltf6v6+HrPX9vB/rgyzwwFxNjCxIWqRGEY:Ue
- TLSH T1C014181F3AE61319F3B7DA4199F64623A73AB9A1A9388E4C41C1034906E6D01FD54FEF
- MD5 SHA1 SHA512 SSDEEP TLSH
adb/boot.cfg
- SHA256 a0130462172ef03869349d9fff564e9f66a76f31fcceded5d7ae5f9c64c42563
- MD5 e94850e3bd4142dc7a9779f694fb3eaa
- SHA1 90d5840cc06e2db3ffd4d085a18723fb5ffd6671
- SHA512 36aca44db3c4309846d8f01605f3b0ae4db438216f1ad59f991b04dbf0ee9c8f18ff5326bd523e36f2b26f9d7c612a006466df2d9a18155cf93bda43ed9b81b8
- SSDEEP 96:Y5ioWaNtxKpTyPhLo5yMliemE6W5lhMrmjqaslAzmxh2tDRnCgbb2VOi+sQNALMH:Y5MWMpT6hMEMlialMrmY7AtDR7/2VSN9
- TLSH T126B19D8E24B98944CC5131EAE4FBC605642AFD408BE25BA0B6B0DD262F006C4EDBC13F
- MD5 SHA1 SHA512 SSDEEP TLSH