WSOCK32[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
WSOCK32.dll
Size 7.8MB
Sample260920-ylt1tsdj4w
SHA256 6964e94beb3f3d32c91fe7b2a5089fa63d0437917106340d8346de16e7ceec3e
MD5 6da675246dffc3e4bda329260e42cd32
SHA1 24dbb8881a0c17757d2dead31539cc8ee5591afd
SHA512 dcbfd17e1843425d312bd2efa11f1dc0b76883dd413eb69b9ad7738b1164ca463fd84253fb1f19d2fa896437ada4676a3f4c1885bb7615c864b2caac316e61c7
SSDEEP 49152:Tiq+0bRnwSPlJUiEt0dpC8MjUO8l1vHdBd9Znqme1B50ysOCWFp07wgm+87QlS1Z:TiCfLqwZMT/0Pm
TLSH
T106869356EA7291D0D5BED0399252B62BFC613C5DC338A3D79B918B461B62BE0F53E300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

WSOCK32.dll

.dll 7.8MB

WSOCK32.dll

IMPHASH cc2b3800932e729a76403dbae72e4d3c
SHA256 6964e94beb3f3d32c91fe7b2a5089fa63d0437917106340d8346de16e7ceec3e
MD5 6da675246dffc3e4bda329260e42cd32
SHA1 24dbb8881a0c17757d2dead31539cc8ee5591afd
SHA512 dcbfd17e1843425d312bd2efa11f1dc0b76883dd413eb69b9ad7738b1164ca463fd84253fb1f19d2fa896437ada4676a3f4c1885bb7615c864b2caac316e61c7
SSDEEP 49152:Tiq+0bRnwSPlJUiEt0dpC8MjUO8l1vHdBd9Znqme1B50ysOCWFp07wgm+87QlS1Z:TiCfLqwZMT/0Pm
TLSH
T106869356EA7291D0D5BED0399252B62BFC613C5DC338A3D79B918B461B62BE0F53E300
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

45:ce:fe:72:d0:c7:d7:57:5b:3a:bf:ac:06:2c:fa:49:73:be:98:0b:84:21:88:2a:91:2b:8f:bd:db:a9:41:7b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Sidetrack Games B.V.,O=Sidetrack Games B.V.,POSTALCODE=1066 EP,STREET=John M. Keynesplein 4,L=Amsterdam,ST=Noord-Holland,C=NL

Chains

Aug 20, 2026

CN=Sidetrack Games B.V.,O=Sidetrack Games B.V.,POSTALCODE=1066 EP,STREET=John M. Keynesplein 4,L=Amsterdam,ST=Noord-Holland,C=NL

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Sidetrack Games B.V.,O=Sidetrack Games B.V.,POSTALCODE=1066 EP,STREET=John M. Keynesplein 4,L=Amsterdam,ST=Noord-Holland,C=NL

Serial Number

33:00:04:8f:c1:7c:94:d6:2b:ff:81:84:47:00:00:00:04:8f:c1

Issuer

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 18, 2026 - Aug 21, 2026

Subject

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:15:05:3e:6e:19:8e:93:29:d9:00:00:00:00:00:15

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:A500-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:56:7e:8f:9d:58:08:8e:e9:60:00:00:00:00:00:56

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

5066

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\PAYDAY2-SuperBLT\PAYDAY2-SuperBLT\build\RelWithDebInfo\WSOCK32.pdb

avrt

AvRevertMmThreadCharacteristics AvSetMmThreadCharacteristicsW

winmm

waveInUnprepareHeader waveInPrepareHeader waveInClose waveInAddBuffer waveInStart waveOutGetNumDevs waveOutGetDevCapsW waveInOpen waveInGetDevCapsW waveInGetNumDevs waveOutWrite waveOutOpen waveOutClose waveOutPrepareHeader waveOutUnprepareHeader waveInStop waveInReset

bcrypt

BCryptOpenAlgorithmProvider BCryptGetProperty BCryptCreateHash BCryptDestroyHash BCryptHashData BCryptGenRandom BCryptCloseAlgorithmProvider BCryptFinishHash

advapi32

CryptDestroyHash CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptAcquireContextA

secur32

InitSecurityInterfaceA

iphlpapi

if_nametoindex

kernel32

GetTempPathW AreFileApisANSI DeviceIoControl SetFileTime CreateDirectoryExW CopyFileW InitializeSListHead GetSystemTimeAsFileTime SetFileAttributesW GetModuleHandleW GetStdHandle SetConsoleTextAttribute AllocConsole FreeConsole SetConsoleCtrlHandler GetConsoleWindow InitializeCriticalSectionAndSpinCount CreateDirectoryA DeleteFileA GetLastError GetProcAddress LoadLibraryA GetCurrentProcess GetTickCount64 GetModuleFileNameA GetModuleHandleA K32GetModuleInformation ExitProcess CloseHandle WaitForSingleObject CreateProcessA GetSystemTime SystemTimeToFileTime FindClose FindFirstFileA FindNextFileA GetFileAttributesA RemoveDirectoryA MoveFileExA GetSystemDirectoryA DisableThreadLibraryCalls GetSystemInfo VirtualAlloc VirtualProtect VirtualFree IsDebuggerPresent DebugBreak TlsGetValue TlsSetValue TlsAlloc TlsFree MultiByteToWideChar WideCharToMultiByte ResetEvent WaitForSingleObjectEx CreateEventW GetCurrentThread SetThreadPriority GetModuleFileNameW ReleaseSemaphore CreateSemaphoreW RaiseException FreeLibrary LoadLibraryW ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceFrequency SleepEx QueryPerformanceCounter GetTickCount Sleep SetLastError CreateFileA GetFullPathNameW CreateThread GetEnvironmentVariableA VerSetConditionMask VerifyVersionInfoW FormatMessageW GetFileSizeEx ReadFile LocalFree RtlUnwindEx VirtualQuery InitializeCriticalSection LoadLibraryExA CreateFileW SetFilePointerEx WriteFile SetCurrentDirectoryW GetCurrentProcessId GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW GetDiskFreeSpaceExW FindNextFileW FindFirstFileExW FindFirstFileW GetLocaleInfoEx FormatMessageA GetCurrentThreadId SleepConditionVariableSRW TryAcquireSRWLockShared TryAcquireSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared SetFileInformationByHandle CreateHardLinkW GetFileInformationByHandleEx CreateDirectoryW CreateSymbolicLinkW InitOnceBeginInitialize InitOnceComplete WakeAllConditionVariable RtlCaptureContext MoveFileExW GetCurrentDirectoryW

user32

PostMessageA GetSystemMenu RemoveMenu GetForegroundWindow MessageBoxA

shell32

SHGetKnownFolderPath

ole32

CoInitializeEx CoCreateInstance PropVariantClear StringFromCLSID CLSIDFromString CoTaskMemFree CoUninitialize

msvcp140

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ _Mtx_lock _Mtx_unlock ?_Throw_Cpp_error@std@@YAXH@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PEAV32@@Z ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A _Thrd_join _Thrd_id _Cnd_do_broadcast_at_thread_exit ?_Xinvalid_argument@std@@YAXPEBD@Z _Query_perf_counter _Query_perf_frequency _Thrd_detach _Cnd_signal ?exceptions@ios_base@std@@QEAAXH@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?is@?$ctype@D@std@@QEBA_NFD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?id@?$ctype@D@std@@2V0locale@2@A ?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?setf@ios_base@std@@QEAAHHH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?fail@ios_base@std@@QEBA_NXZ ?bad@ios_base@std@@QEBA_NXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?id@?$numpunct@D@std@@2V0locale@2@A ??7ios_base@std@@QEBA_NXZ ?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ??Bios_base@std@@QEBA_NXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?swap@?$basic_ostream@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z _Mtx_init_in_situ ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ _Thrd_yield ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z _Cnd_init_in_situ _Cnd_wait _Cnd_broadcast _Cnd_register_at_thread_exit _Cnd_unregister_at_thread_exit ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?eof@ios_base@std@@QEBA_NXZ ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QEBA_JXZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@AEAD@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ ?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?uncaught_exceptions@std@@YAHXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z

vcruntime140

_purecall memmove memcmp strstr strrchr __std_exception_copy __std_terminate __DestructExceptionObject __current_exception __std_type_info_destroy_list memchr strchr memcpy memset __RTDynamicCast __std_exception_destroy __C_specific_handler _CxxThrowException __current_exception_context

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_onexit_function _crt_at_quick_exit _initialize_narrow_environment _configure_narrow_argv _execute_onexit_table _seh_filter_dll _cexit strerror_s _initterm _initialize_onexit_table strerror _errno abort exit _invoke_watson _beginthreadex terminate _initterm_e

api-ms-win-crt-stdio-l1-1-0

ungetc setvbuf fwrite _fseeki64 fsetpos fread __stdio_common_vsprintf fopen_s __stdio_common_vsprintf_s fopen getc freopen_s fseek ftell putc _wfopen __stdio_common_vfprintf _write _read _open _close putchar fputs __acrt_iob_func _get_stream_buffer_pointers fclose fgets _sopen_s _fsopen fflush fgetc fgetpos fputc feof __stdio_common_vsscanf rewind ferror clearerr _lseeki64

api-ms-win-crt-filesystem-l1-1-0

_splitpath_s _lock_file remove _fullpath _stat64i32 _unlink _unlock_file _stat64 rename

api-ms-win-crt-heap-l1-1-0

realloc _aligned_free calloc _callnewh malloc _aligned_malloc free

api-ms-win-crt-string-l1-1-0

wcscpy_s wcsncpy_s wcsncmp strpbrk strncmp strncpy toupper towupper strcpy strspn isupper tolower strcmp strcat_s strncpy_s _strdup strlen wcslen isspace isalnum strcspn

api-ms-win-crt-math-l1-1-0

lround sinh sinhf cbrtf atanf copysignf _hypotf tanf copysign powf log10f tan sqrt log2 fmod ceil asinf log2f atan expf acos trunc round modf fmin floorf ceilf _dsign fmax cbrt log10 cosh tanh frexp sin acosf atan2f atan2 _ldsign _fdsign _dclass _fdclass _ldclass roundf cosf ldexp sqrtf _fdopen asin sinf pow log floor exp cos logf

api-ms-win-crt-convert-l1-1-0

wcstombs_s strtol strtod atoi strtof strtoul strtoull strtoll mbstowcs_s

api-ms-win-crt-time-l1-1-0

_time64 strftime _gmtime64_s _localtime64_s clock

api-ms-win-crt-utility-l1-1-0

srand rand qsort

api-ms-win-crt-environment-l1-1-0

_wgetenv getenv

api-ms-win-crt-multibyte-l1-1-0

_mbsnbcmp _mbsnbcpy_s _mbschr

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

crypt32

CertFreeCRLContext CertAddCertificateContextToStore CertFreeCTLContext CertFindExtension PFXImportCertStore CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertOpenStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CryptDecodeObjectEx CertGetNameStringA

ws2_32

WSAEventSelect select WSAResetEvent WSASetEvent __WSAFDIsSet htonl WSAEnumNetworkEvents WSACreateEvent listen getaddrinfo WSACloseEvent freeaddrinfo closesocket WSAGetLastError send WSAIoctl htons socket ntohs WSAStartup WSACleanup getsockopt WSASetLastError setsockopt ioctlsocket accept bind connect getpeername getsockname recv WSAWaitForMultipleEvents WSAStringToAddressW

AcceptEx AddIPAddress AllocateAndGetInterfaceInfoFromStack AllocateAndGetIpAddrTableFromStack CancelIPChangeNotify CancelMibChangeNotify2 CloseCompartment CloseGetIPPhysicalInterfaceForDestination ConvertCompartmentGuidToId ConvertCompartmentIdToGuid ConvertGuidToStringA ConvertGuidToStringW ConvertInterfaceAliasToLuid ConvertInterfaceGuidToLuid ConvertInterfaceIndexToLuid ConvertInterfaceLuidToAlias ConvertInterfaceLuidToGuid ConvertInterfaceLuidToIndex ConvertInterfaceLuidToNameA ConvertInterfaceLuidToNameW ConvertInterfaceNameToLuidA ConvertInterfaceNameToLuidW ConvertInterfacePhysicalAddressToLuid ConvertIpv4MaskToLength ConvertLengthToIpv4Mask ConvertRemoteInterfaceAliasToLuid ConvertRemoteInterfaceGuidToLuid ConvertRemoteInterfaceIndexToLuid ConvertRemoteInterfaceLuidToAlias ConvertRemoteInterfaceLuidToGuid ConvertRemoteInterfaceLuidToIndex ConvertStringToGuidA ConvertStringToGuidW ConvertStringToInterfacePhysicalAddress CreateAnycastIpAddressEntry CreateIpForwardEntry CreateIpForwardEntry2 CreateIpNetEntry CreateIpNetEntry2 CreatePersistentTcpPortReservation CreatePersistentUdpPortReservation CreateProxyArpEntry CreateSortedAddressPairs CreateUnicastIpAddressEntry DeleteAnycastIpAddressEntry DeleteIPAddress DeleteIpForwardEntry DeleteIpForwardEntry2 DeleteIpNetEntry DeleteIpNetEntry2 DeletePersistentTcpPortReservation DeletePersistentUdpPortReservation DeleteProxyArpEntry DeleteUnicastIpAddressEntry DisableMediaSense EnableRouter EnumProtocolsA EnumProtocolsW FlushIpNetTable FlushIpNetTable2 FlushIpPathTable FreeMibTable GetAcceptExSockaddrs GetAdapterIndex GetAdapterOrderMap GetAdaptersAddresses GetAdaptersInfo GetAddressByNameA GetAddressByNameW GetAnycastIpAddressEntry GetAnycastIpAddressTable GetBestInterface GetBestInterfaceEx GetBestRoute GetBestRoute2 GetCurrentThreadCompartmentId GetExtendedTcpTable GetExtendedUdpTable GetFriendlyIfIndex GetIcmpStatistics GetIcmpStatisticsEx GetIfEntry GetIfEntry2 GetIfStackTable GetIfTable GetIfTable2 GetIfTable2Ex GetInterfaceInfo GetInvertedIfStackTable GetIpAddrTable GetIpErrorString GetIpForwardEntry2 GetIpForwardTable GetIpForwardTable2 GetIpInterfaceEntry GetIpInterfaceTable GetIpNetEntry2 GetIpNetTable GetIpNetTable2 GetIpNetworkConnectionBandwidthEstimates GetIpPathEntry GetIpPathTable GetIpStatistics GetIpStatisticsEx GetMulticastIpAddressEntry GetMulticastIpAddressTable GetNameByTypeA GetNameByTypeW GetNetworkInformation GetNetworkParams GetNumberOfInterfaces GetOwnerModuleFromPidAndInfo GetOwnerModuleFromTcp6Entry GetOwnerModuleFromTcpEntry GetOwnerModuleFromUdp6Entry GetOwnerModuleFromUdpEntry GetPerAdapterInfo GetPerTcp6ConnectionEStats GetPerTcp6ConnectionStats GetPerTcpConnectionEStats GetPerTcpConnectionStats GetRTTAndHopCount GetServiceA GetServiceW GetSessionCompartmentId GetTcp6Table GetTcp6Table2 GetTcpStatistics GetTcpStatisticsEx GetTcpTable GetTcpTable2 GetTeredoPort GetTypeByNameA GetTypeByNameW GetUdp6Table GetUdpStatistics GetUdpStatisticsEx GetUdpTable GetUniDirectionalAdapterInfo GetUnicastIpAddressEntry GetUnicastIpAddressTable Icmp6CreateFile Icmp6ParseReplies Icmp6SendEcho2 IcmpCloseHandle IcmpCreateFile IcmpParseReplies IcmpSendEcho IcmpSendEcho2 IcmpSendEcho2Ex InitializeIpForwardEntry InitializeIpInterfaceEntry InitializeUnicastIpAddressEntry InternalCleanupPersistentStore InternalCreateAnycastIpAddressEntry InternalCreateIpForwardEntry InternalCreateIpForwardEntry2 InternalCreateIpNetEntry InternalCreateIpNetEntry2 InternalCreateUnicastIpAddressEntry InternalDeleteAnycastIpAddressEntry InternalDeleteIpForwardEntry InternalDeleteIpForwardEntry2 InternalDeleteIpNetEntry InternalDeleteIpNetEntry2 InternalDeleteUnicastIpAddressEntry InternalFindInterfaceByAddress InternalGetAnycastIpAddressEntry InternalGetAnycastIpAddressTable InternalGetForwardIpTable2 InternalGetIPPhysicalInterfaceForDestination InternalGetIfEntry2 InternalGetIfTable InternalGetIfTable2 InternalGetIpAddrTable InternalGetIpForwardEntry2 InternalGetIpForwardTable InternalGetIpInterfaceEntry InternalGetIpInterfaceTable InternalGetIpNetEntry2 InternalGetIpNetTable InternalGetIpNetTable2 InternalGetMulticastIpAddressEntry InternalGetMulticastIpAddressTable InternalGetRtcSlotInformation InternalGetTcp6Table2 InternalGetTcp6TableWithOwnerModule InternalGetTcp6TableWithOwnerPid InternalGetTcpTable InternalGetTcpTable2 InternalGetTcpTableEx InternalGetTcpTableWithOwnerModule InternalGetTcpTableWithOwnerPid InternalGetTunnelPhysicalAdapter InternalGetUdp6TableWithOwnerModule InternalGetUdp6TableWithOwnerPid InternalGetUdpTable InternalGetUdpTableEx InternalGetUdpTableWithOwnerModule InternalGetUdpTableWithOwnerPid InternalGetUnicastIpAddressEntry InternalGetUnicastIpAddressTable InternalIcmpCreateFileEx InternalSetIfEntry InternalSetIpForwardEntry InternalSetIpForwardEntry2 InternalSetIpInterfaceEntry InternalSetIpNetEntry InternalSetIpNetEntry2 InternalSetIpStats InternalSetTcpEntry InternalSetTeredoPort InternalSetUnicastIpAddressEntry IpReleaseAddress IpRenewAddress LookupPersistentTcpPortReservation LookupPersistentUdpPortReservation MigrateWinsockConfiguration NPLoadNameSpaces NTPTimeToNTFileTime NTTimeToNTPTime NhGetGuidFromInterfaceName NhGetInterfaceDescriptionFromGuid NhGetInterfaceNameFromDeviceGuid NhGetInterfaceNameFromGuid NhpAllocateAndGetInterfaceInfoFromStack NotifyAddrChange NotifyCompartmentChange NotifyIpInterfaceChange NotifyRouteChange NotifyRouteChange2 NotifyStableUnicastIpAddressTable NotifyTeredoPortChange NotifyUnicastIpAddressChange OpenCompartment ParseNetworkString RUNDLL_DoUpdateCheck RUNDLL_InstallUpdate ResolveIpNetEntry2 ResolveNeighbor RestoreMediaSense SendARP SetAdapterIpAddress SetCurrentThreadCompartmentId SetIfEntry SetIpForwardEntry SetIpForwardEntry2 SetIpInterfaceEntry SetIpNetEntry SetIpNetEntry2 SetIpStatistics SetIpStatisticsEx SetIpTTL SetNetworkInformation SetPerTcp6ConnectionEStats SetPerTcp6ConnectionStats SetPerTcpConnectionEStats SetPerTcpConnectionStats SetServiceA SetServiceW SetSessionCompartmentId SetTcpEntry SetUnicastIpAddressEntry TransmitFile UnenableRouter WEP WSAAsyncGetHostByAddr WSAAsyncGetHostByName WSAAsyncGetProtoByName WSAAsyncGetProtoByNumber WSAAsyncGetServByName WSAAsyncGetServByPort WSAAsyncSelect WSACancelAsyncRequest WSACancelBlockingCall WSACleanup WSAGetLastError WSAIsBlocking WSARecvEx WSASetBlockingHook WSASetLastError WSAStartup WSAUnhookBlockingHook WSApSetPostRoutine _PfAddFiltersToInterface@24 _PfAddGlobalFilterToInterface@8 _PfBindInterfaceToIPAddress@12 _PfBindInterfaceToIndex@16 _PfCreateInterface@24 _PfDeleteInterface@4 _PfDeleteLog@0 _PfGetInterfaceStatistics@16 _PfMakeLog@4 _PfRebindFilters@8 _PfRemoveFilterHandles@12 _PfRemoveFiltersFromInterface@20 _PfRemoveGlobalFilterFromInterface@8 _PfSetLogBuffer@28 _PfTestPacket@20 _PfUnBindInterface@4 __WSAFDIsSet accept bind closesocket connect dn_expand do_echo_rep do_echo_req gethostbyaddr gethostbyname gethostname getnetbyname getpeername getprotobyname getprotobynumber getservbyname getservbyport getsockname getsockopt htonl htons if_indextoname if_nametoindex inet_addr inet_network inet_ntoa ioctlsocket listen ntohl ntohs rcmd recv recvfrom register_icmp rexec rresvport s_perror select send sendto sethostname setsockopt shutdown socket

Name

.text

Size

6.1MB

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

50KB

Virtual Size

647KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

229KB

Virtual Size

228KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

WSOCK32.dll

avrt

winmm

bcrypt

advapi32

secur32

iphlpapi

kernel32

user32

shell32

ole32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-locale-l1-1-0

crypt32

ws2_32

generic