SuperBLT-v4[.]3-beta[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
SuperBLT-v4.3-beta.zip
Size 7.9MB
Sample260922-rawa7afh89
SHA256 a65e0c47603610fdb3691f4601c8629327d20447b9b972a0e870f00ee758946d
MD5 e3fecb3bd8f05044387c850539cb009b
SHA1 d2bce7c1ce3f8933c7c769b486af4a306d947ba9
SHA512 8996697a56da6cad745cdf10817d35f0b3dae0abba7def8a8beb09157912659398bf296e2d2ccbc47e54a51808d6db568823386b7fdb719c73c4bff4c62e65ab
SSDEEP 49152:r1pGnT4CpqhQ8WlVaq3WiuDHzQSjoUO8l1vddPDkSnzVaDt5AdfCQ1Ij5BaEo/N1:zDkIqYD0vgLr0sn
TLSH
T10F869346EA7291D0D5BED0399256B62BFC613C5DC338B3D79B918B461B62BE0E53E300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/WSOCK32.dll

File Explorer

SuperBLT-v4.3-beta.zip

.zip 7.9MB
README.txt

542B
WSOCK32.dll

.dll 7.8MB
WSOCK32.dll.sig

3KB
epic-step-1.png

.png 43KB
epic-step-2.png

.png 39KB

SuperBLT-v4.3-beta.zip

SHA256 a65e0c47603610fdb3691f4601c8629327d20447b9b972a0e870f00ee758946d
MD5 e3fecb3bd8f05044387c850539cb009b
SHA1 d2bce7c1ce3f8933c7c769b486af4a306d947ba9
SHA512 8996697a56da6cad745cdf10817d35f0b3dae0abba7def8a8beb09157912659398bf296e2d2ccbc47e54a51808d6db568823386b7fdb719c73c4bff4c62e65ab
SSDEEP 49152:r1pGnT4CpqhQ8WlVaq3WiuDHzQSjoUO8l1vddPDkSnzVaDt5AdfCQ1Ij5BaEo/N1:zDkIqYD0vgLr0sn
TLSH
T10F869346EA7291D0D5BED0399256B62BFC613C5DC338B3D79B918B461B62BE0E53E300
MD5 SHA1 SHA512 SSDEEP TLSH

WSOCK32.dll

IMPHASH 02648a291f8a61b710ceda2b58792784
SHA256 6d568883085bc9c3d5e8ff576c4f2e6a410acb75f8c8a9af895d1b319d4a7b8d
MD5 8fe159925a191b2ba499cd1e2dc45783
SHA1 7c0919eb5eac0d8c4c156254419451d772df1274
SHA512 2672d57cc560ba7cb3933941a6b468d5df8e722e47627085c033df1446d6dcd126693b78860c4c7ebc5facd6f05b69a3dcb192256b6af3994486f45e35d2e4fa
SSDEEP 49152:d1pGnT4CpqhQ8WlVaq3WiuDHzQSjoUO8l1vddPDkSnzVaDt5AdfCQ1Ij5BaEo/Nc:9DkIqYD0vgLr0s
TLSH
T1E0869346EA7291D0D5BED0399256B62BFC613C5DC338B3D79B918B461B62BE0E53E300
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5076

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\PAYDAY2-SuperBLT\PAYDAY2-SuperBLT\build\RelWithDebInfo\WSOCK32.pdb

avrt

AvRevertMmThreadCharacteristics AvSetMmThreadCharacteristicsW

winmm

waveOutGetNumDevs waveOutGetDevCapsW waveOutOpen waveOutClose waveOutPrepareHeader waveOutUnprepareHeader waveOutWrite waveInReset waveInStop waveInStart waveInAddBuffer waveInGetNumDevs waveInGetDevCapsW waveInOpen waveInClose waveInUnprepareHeader waveInPrepareHeader

bcrypt

BCryptCloseAlgorithmProvider BCryptHashData BCryptGetProperty BCryptOpenAlgorithmProvider BCryptFinishHash BCryptDestroyHash BCryptGenRandom BCryptCreateHash

advapi32

CryptDestroyHash CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptAcquireContextA

secur32

InitSecurityInterfaceA

iphlpapi

if_nametoindex

kernel32

GetTempPathW AreFileApisANSI DeviceIoControl SetFileTime CreateDirectoryExW CopyFileW InitializeSListHead GetSystemTimeAsFileTime SetFileAttributesW GetModuleHandleW GetStdHandle SetConsoleTextAttribute AllocConsole FreeConsole SetConsoleCtrlHandler GetConsoleWindow InitializeCriticalSectionAndSpinCount CreateDirectoryA DeleteFileA GetLastError GetProcAddress LoadLibraryA GetCurrentProcess GetTickCount64 GetModuleFileNameA GetModuleHandleA K32GetModuleInformation ExitProcess CloseHandle WaitForSingleObject CreateProcessA GetSystemTime SystemTimeToFileTime FindClose FindFirstFileA FindNextFileA GetFileAttributesA RemoveDirectoryA MoveFileExA GetSystemDirectoryA DisableThreadLibraryCalls GetSystemInfo VirtualAlloc VirtualProtect VirtualFree IsDebuggerPresent DebugBreak TlsGetValue TlsSetValue TlsAlloc TlsFree MultiByteToWideChar WideCharToMultiByte ResetEvent WaitForSingleObjectEx CreateEventW GetCurrentThread SetThreadPriority GetModuleFileNameW ReleaseSemaphore CreateSemaphoreW RaiseException FreeLibrary LoadLibraryW ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceFrequency SleepEx QueryPerformanceCounter GetTickCount Sleep SetLastError CreateFileA GetFullPathNameW CreateThread GetEnvironmentVariableA VerSetConditionMask VerifyVersionInfoW FormatMessageW GetFileSizeEx ReadFile LocalFree RtlUnwindEx VirtualQuery InitializeCriticalSection LoadLibraryExA CreateFileW SetFilePointerEx WriteFile SetCurrentDirectoryW GetCurrentProcessId GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW GetDiskFreeSpaceExW FindNextFileW FindFirstFileExW FindFirstFileW GetLocaleInfoEx FormatMessageA GetCurrentThreadId SleepConditionVariableSRW TryAcquireSRWLockShared TryAcquireSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared SetFileInformationByHandle CreateHardLinkW GetFileInformationByHandleEx CreateDirectoryW CreateSymbolicLinkW InitOnceBeginInitialize InitOnceComplete WakeAllConditionVariable RtlCaptureContext MoveFileExW GetCurrentDirectoryW

user32

PostMessageA GetSystemMenu RemoveMenu GetForegroundWindow MessageBoxA

shell32

SHGetKnownFolderPath

ole32

CoUninitialize CoInitializeEx CoCreateInstance PropVariantClear StringFromCLSID CLSIDFromString CoTaskMemFree

msvcp140

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ _Mtx_lock _Mtx_unlock ?_Throw_Cpp_error@std@@YAXH@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PEAV32@@Z ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A _Thrd_join _Thrd_id _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Query_perf_frequency _Thrd_detach _Cnd_signal ?exceptions@ios_base@std@@QEAAXH@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?is@?$ctype@D@std@@QEBA_NFD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?id@?$ctype@D@std@@2V0locale@2@A ?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?setf@ios_base@std@@QEAAHHH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?fail@ios_base@std@@QEBA_NXZ ?bad@ios_base@std@@QEBA_NXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?id@?$numpunct@D@std@@2V0locale@2@A ??7ios_base@std@@QEBA_NXZ ?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ??Bios_base@std@@QEBA_NXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?swap@?$basic_ostream@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z _Mtx_init_in_situ ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ _Thrd_yield ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z _Cnd_init_in_situ _Cnd_wait _Cnd_broadcast _Cnd_register_at_thread_exit _Cnd_unregister_at_thread_exit ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?eof@ios_base@std@@QEBA_NXZ ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QEBA_JXZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@AEAD@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ ?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?uncaught_exceptions@std@@YAHXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z

vcruntime140

memchr memmove memcmp strstr strrchr __std_exception_copy __std_terminate __DestructExceptionObject __current_exception __std_type_info_destroy_list _purecall strchr memcpy memset __RTDynamicCast __std_exception_destroy __C_specific_handler _CxxThrowException __current_exception_context

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

strerror _beginthreadex terminate strerror_s _crt_at_quick_exit _invoke_watson _initterm_e _initterm _errno _register_onexit_function _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment abort exit _cexit _initialize_onexit_table _execute_onexit_table _crt_atexit

api-ms-win-crt-stdio-l1-1-0

ungetc setvbuf fwrite _fseeki64 fsetpos fread __stdio_common_vfprintf __stdio_common_vsprintf freopen_s _lseeki64 fopen_s putchar _write _read __stdio_common_vsprintf_s _close fopen getc fseek fgets _sopen_s _fsopen ftell putc __acrt_iob_func _get_stream_buffer_pointers fclose feof fflush rewind ferror clearerr _open fgetc fgetpos fputs _wfopen fputc __stdio_common_vsscanf

api-ms-win-crt-filesystem-l1-1-0

_stat64i32 _unlink _splitpath_s _unlock_file _lock_file remove rename _stat64 _fullpath

api-ms-win-crt-heap-l1-1-0

_aligned_malloc calloc free malloc _callnewh realloc _aligned_free

api-ms-win-crt-string-l1-1-0

towupper toupper strcspn strpbrk wcscpy_s wcsncpy_s strspn _strdup isalnum wcsncmp strncmp isupper tolower strlen strncpy_s strcpy strncpy wcslen strcmp strcat_s isspace

api-ms-win-crt-convert-l1-1-0

wcstombs_s strtoll strtod strtoul strtol strtof strtoull mbstowcs_s atoi

api-ms-win-crt-math-l1-1-0

asin sinh sinhf cbrtf atanf copysignf _hypotf tanf copysign acos trunc round sinf modf fmin fmax cosf atan pow atan2f roundf floor exp cos logf ldexp _ldclass _fdclass _dclass _fdsign log10 cosh tanh frexp _ldsign sin expf _dsign asinf acosf floorf ceilf ceil sqrt tan fmod log10f atan2 log2 log powf log2f sqrtf cbrt lround _fdopen

api-ms-win-crt-time-l1-1-0

clock _gmtime64_s _localtime64_s strftime _time64

api-ms-win-crt-utility-l1-1-0

srand rand qsort

api-ms-win-crt-environment-l1-1-0

getenv _wgetenv

api-ms-win-crt-multibyte-l1-1-0

_mbsnbcpy_s _mbschr _mbsnbcmp

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

crypt32

CertFreeCRLContext CertAddCertificateContextToStore CertFreeCTLContext CertFindExtension PFXImportCertStore CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertOpenStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CryptDecodeObjectEx CertGetNameStringA

ws2_32

WSAEnumNetworkEvents WSAEventSelect ioctlsocket WSASetEvent WSAWaitForMultipleEvents closesocket select WSACloseEvent send getsockopt htonl listen WSAGetLastError htons WSACreateEvent socket ntohs __WSAFDIsSet WSAIoctl WSAStartup WSACleanup getaddrinfo WSASetLastError setsockopt WSAResetEvent accept bind connect getpeername getsockname recv WSAStringToAddressW freeaddrinfo

AcceptEx AddIPAddress AllocateAndGetInterfaceInfoFromStack AllocateAndGetIpAddrTableFromStack CancelIPChangeNotify CancelMibChangeNotify2 CloseCompartment CloseGetIPPhysicalInterfaceForDestination ConvertCompartmentGuidToId ConvertCompartmentIdToGuid ConvertGuidToStringA ConvertGuidToStringW ConvertInterfaceAliasToLuid ConvertInterfaceGuidToLuid ConvertInterfaceIndexToLuid ConvertInterfaceLuidToAlias ConvertInterfaceLuidToGuid ConvertInterfaceLuidToIndex ConvertInterfaceLuidToNameA ConvertInterfaceLuidToNameW ConvertInterfaceNameToLuidA ConvertInterfaceNameToLuidW ConvertInterfacePhysicalAddressToLuid ConvertIpv4MaskToLength ConvertLengthToIpv4Mask ConvertRemoteInterfaceAliasToLuid ConvertRemoteInterfaceGuidToLuid ConvertRemoteInterfaceIndexToLuid ConvertRemoteInterfaceLuidToAlias ConvertRemoteInterfaceLuidToGuid ConvertRemoteInterfaceLuidToIndex ConvertStringToGuidA ConvertStringToGuidW ConvertStringToInterfacePhysicalAddress CreateAnycastIpAddressEntry CreateIpForwardEntry CreateIpForwardEntry2 CreateIpNetEntry CreateIpNetEntry2 CreatePersistentTcpPortReservation CreatePersistentUdpPortReservation CreateProxyArpEntry CreateSortedAddressPairs CreateUnicastIpAddressEntry DeleteAnycastIpAddressEntry DeleteIPAddress DeleteIpForwardEntry DeleteIpForwardEntry2 DeleteIpNetEntry DeleteIpNetEntry2 DeletePersistentTcpPortReservation DeletePersistentUdpPortReservation DeleteProxyArpEntry DeleteUnicastIpAddressEntry DisableMediaSense EnableRouter EnumProtocolsA EnumProtocolsW FlushIpNetTable FlushIpNetTable2 FlushIpPathTable FreeMibTable GetAcceptExSockaddrs GetAdapterIndex GetAdapterOrderMap GetAdaptersAddresses GetAdaptersInfo GetAddressByNameA GetAddressByNameW GetAnycastIpAddressEntry GetAnycastIpAddressTable GetBestInterface GetBestInterfaceEx GetBestRoute GetBestRoute2 GetCurrentThreadCompartmentId GetExtendedTcpTable GetExtendedUdpTable GetFriendlyIfIndex GetIcmpStatistics GetIcmpStatisticsEx GetIfEntry GetIfEntry2 GetIfStackTable GetIfTable GetIfTable2 GetIfTable2Ex GetInterfaceInfo GetInvertedIfStackTable GetIpAddrTable GetIpErrorString GetIpForwardEntry2 GetIpForwardTable GetIpForwardTable2 GetIpInterfaceEntry GetIpInterfaceTable GetIpNetEntry2 GetIpNetTable GetIpNetTable2 GetIpNetworkConnectionBandwidthEstimates GetIpPathEntry GetIpPathTable GetIpStatistics GetIpStatisticsEx GetMulticastIpAddressEntry GetMulticastIpAddressTable GetNameByTypeA GetNameByTypeW GetNetworkInformation GetNetworkParams GetNumberOfInterfaces GetOwnerModuleFromPidAndInfo GetOwnerModuleFromTcp6Entry GetOwnerModuleFromTcpEntry GetOwnerModuleFromUdp6Entry GetOwnerModuleFromUdpEntry GetPerAdapterInfo GetPerTcp6ConnectionEStats GetPerTcp6ConnectionStats GetPerTcpConnectionEStats GetPerTcpConnectionStats GetRTTAndHopCount GetServiceA GetServiceW GetSessionCompartmentId GetTcp6Table GetTcp6Table2 GetTcpStatistics GetTcpStatisticsEx GetTcpTable GetTcpTable2 GetTeredoPort GetTypeByNameA GetTypeByNameW GetUdp6Table GetUdpStatistics GetUdpStatisticsEx GetUdpTable GetUniDirectionalAdapterInfo GetUnicastIpAddressEntry GetUnicastIpAddressTable Icmp6CreateFile Icmp6ParseReplies Icmp6SendEcho2 IcmpCloseHandle IcmpCreateFile IcmpParseReplies IcmpSendEcho IcmpSendEcho2 IcmpSendEcho2Ex InitializeIpForwardEntry InitializeIpInterfaceEntry InitializeUnicastIpAddressEntry InternalCleanupPersistentStore InternalCreateAnycastIpAddressEntry InternalCreateIpForwardEntry InternalCreateIpForwardEntry2 InternalCreateIpNetEntry InternalCreateIpNetEntry2 InternalCreateUnicastIpAddressEntry InternalDeleteAnycastIpAddressEntry InternalDeleteIpForwardEntry InternalDeleteIpForwardEntry2 InternalDeleteIpNetEntry InternalDeleteIpNetEntry2 InternalDeleteUnicastIpAddressEntry InternalFindInterfaceByAddress InternalGetAnycastIpAddressEntry InternalGetAnycastIpAddressTable InternalGetForwardIpTable2 InternalGetIPPhysicalInterfaceForDestination InternalGetIfEntry2 InternalGetIfTable InternalGetIfTable2 InternalGetIpAddrTable InternalGetIpForwardEntry2 InternalGetIpForwardTable InternalGetIpInterfaceEntry InternalGetIpInterfaceTable InternalGetIpNetEntry2 InternalGetIpNetTable InternalGetIpNetTable2 InternalGetMulticastIpAddressEntry InternalGetMulticastIpAddressTable InternalGetRtcSlotInformation InternalGetTcp6Table2 InternalGetTcp6TableWithOwnerModule InternalGetTcp6TableWithOwnerPid InternalGetTcpTable InternalGetTcpTable2 InternalGetTcpTableEx InternalGetTcpTableWithOwnerModule InternalGetTcpTableWithOwnerPid InternalGetTunnelPhysicalAdapter InternalGetUdp6TableWithOwnerModule InternalGetUdp6TableWithOwnerPid InternalGetUdpTable InternalGetUdpTableEx InternalGetUdpTableWithOwnerModule InternalGetUdpTableWithOwnerPid InternalGetUnicastIpAddressEntry InternalGetUnicastIpAddressTable InternalIcmpCreateFileEx InternalSetIfEntry InternalSetIpForwardEntry InternalSetIpForwardEntry2 InternalSetIpInterfaceEntry InternalSetIpNetEntry InternalSetIpNetEntry2 InternalSetIpStats InternalSetTcpEntry InternalSetTeredoPort InternalSetUnicastIpAddressEntry IpReleaseAddress IpRenewAddress LookupPersistentTcpPortReservation LookupPersistentUdpPortReservation MigrateWinsockConfiguration NPLoadNameSpaces NTPTimeToNTFileTime NTTimeToNTPTime NhGetGuidFromInterfaceName NhGetInterfaceDescriptionFromGuid NhGetInterfaceNameFromDeviceGuid NhGetInterfaceNameFromGuid NhpAllocateAndGetInterfaceInfoFromStack NotifyAddrChange NotifyCompartmentChange NotifyIpInterfaceChange NotifyRouteChange NotifyRouteChange2 NotifyStableUnicastIpAddressTable NotifyTeredoPortChange NotifyUnicastIpAddressChange OpenCompartment ParseNetworkString RUNDLL_DoUpdateCheck RUNDLL_InstallUpdate ResolveIpNetEntry2 ResolveNeighbor RestoreMediaSense SendARP SetAdapterIpAddress SetCurrentThreadCompartmentId SetIfEntry SetIpForwardEntry SetIpForwardEntry2 SetIpInterfaceEntry SetIpNetEntry SetIpNetEntry2 SetIpStatistics SetIpStatisticsEx SetIpTTL SetNetworkInformation SetPerTcp6ConnectionEStats SetPerTcp6ConnectionStats SetPerTcpConnectionEStats SetPerTcpConnectionStats SetServiceA SetServiceW SetSessionCompartmentId SetTcpEntry SetUnicastIpAddressEntry TransmitFile UnenableRouter WEP WSAAsyncGetHostByAddr WSAAsyncGetHostByName WSAAsyncGetProtoByName WSAAsyncGetProtoByNumber WSAAsyncGetServByName WSAAsyncGetServByPort WSAAsyncSelect WSACancelAsyncRequest WSACancelBlockingCall WSACleanup WSAGetLastError WSAIsBlocking WSARecvEx WSASetBlockingHook WSASetLastError WSAStartup WSAUnhookBlockingHook WSApSetPostRoutine _PfAddFiltersToInterface@24 _PfAddGlobalFilterToInterface@8 _PfBindInterfaceToIPAddress@12 _PfBindInterfaceToIndex@16 _PfCreateInterface@24 _PfDeleteInterface@4 _PfDeleteLog@0 _PfGetInterfaceStatistics@16 _PfMakeLog@4 _PfRebindFilters@8 _PfRemoveFilterHandles@12 _PfRemoveFiltersFromInterface@20 _PfRemoveGlobalFilterFromInterface@8 _PfSetLogBuffer@28 _PfTestPacket@20 _PfUnBindInterface@4 __WSAFDIsSet accept bind closesocket connect dn_expand do_echo_rep do_echo_req gethostbyaddr gethostbyname gethostname getnetbyname getpeername getprotobyname getprotobynumber getservbyname getservbyport getsockname getsockopt htonl htons if_indextoname if_nametoindex inet_addr inet_network inet_ntoa ioctlsocket listen ntohl ntohs rcmd recv recvfrom register_icmp rexec rresvport s_perror select send sendto sethostname setsockopt shutdown socket

Name

.text

Size

6.2MB

Virtual Size

6.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

50KB

Virtual Size

647KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

229KB

Virtual Size

229KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SuperBLT-v4.3-beta.zip

README.txt

WSOCK32.dll

avrt

winmm

bcrypt

advapi32

secur32

iphlpapi

kernel32

user32

shell32

ole32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-locale-l1-1-0

crypt32

ws2_32

generic

WSOCK32.dll.sig

epic-step-1.png

epic-step-2.png