SeaghostShield-Setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SeaghostShield-Setup.exe
Size 44.9MB
Sample260930-pay1zatt4k
SHA256 ba71e77d6420255775e32755d254466a08fd900b9ddd82a331aaa9e32e09a192
MD5 b3ee7cff95f4cbc0239e7d29bbc5a37a
SHA1 38b1915f8645af004dda4fc04817e7f655747a40
SHA512 474bde05fe3e64aedd20daeeff7b4326bffbdf6e06683b0f4b060291ae900fb4e85cf93b674272c5795a471833403d88ed5f50000045aa9e388ad57571d28239
SSDEEP 786432:QwSY6KesV0qqhlokOzr60h0huRYRTPBLaaRgXyuVldc/3SOxUXVaWS5fq1vgxBTe:Qen7VDdVapUYRTPcaoyWq3SOeIWS5f4T
TLSH
T193A7338D165EB794F1A41B3234B23419593C08648F6FA48F69EB379EB1737C838963D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
SeaghostShield-Setup.exe
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/SeaghostShield.exe

File Explorer

SeaghostShield-Setup.exe

.exe 44.9MB
$PLUGINSDIR/System.dll

.dll 28KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 14KB
$PLUGINSDIR/nsExec.dll

.dll 10KB
SeaghostShield.exe

.exe 51.2MB

SeaghostShield-Setup.exe

IMPHASH f4d1e4cd7416ef83f79f7c6a038875b3
SHA256 ba71e77d6420255775e32755d254466a08fd900b9ddd82a331aaa9e32e09a192
MD5 b3ee7cff95f4cbc0239e7d29bbc5a37a
SHA1 38b1915f8645af004dda4fc04817e7f655747a40
SHA512 474bde05fe3e64aedd20daeeff7b4326bffbdf6e06683b0f4b060291ae900fb4e85cf93b674272c5795a471833403d88ed5f50000045aa9e388ad57571d28239
SSDEEP 786432:QwSY6KesV0qqhlokOzr60h0huRYRTPBLaaRgXyuVldc/3SOxUXVaWS5fq1vgxBTe:Qen7VDdVapUYRTPcaoyWq3SOeIWS5f4T
TLSH
T193A7338D165EB794F1A41B3234B23419593C08648F6FA48F69EB379EB1737C838963D2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17828

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectW DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileW CreateDirectoryW CreateFileW CreateProcessW CreateThread DeleteFileW ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileW FindNextFileW FreeLibrary GetCommandLineW GetCurrentProcess GetDiskFreeSpaceW GetExitCodeProcess GetFileAttributesW GetFileSize GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetShortPathNameW GetSystemDirectoryW GetTempFileNameW GetTempPathW GetTickCount GetVersionExW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryExW MoveFileExW MoveFileW MulDiv MultiByteToWideChar ReadFile RemoveDirectoryW SearchPathW SetCurrentDirectoryW SetEnvironmentVariableW SetErrorMode SetFileAttributesW SetFilePointer SetFileTime Sleep WaitForSingleObject WideCharToMultiByte WriteFile WritePrivateProfileStringW lstrcatW lstrcmpW lstrcmpiA lstrcmpiW lstrcpyA lstrcpynW lstrlenA lstrlenW

ole32

CoCreateInstance CoTaskMemFree IIDFromString OleInitialize OleUninitialize

shell32

SHBrowseForFolderW SHFileOperationW SHGetFileInfoW SHGetPathFromIDListW ShellExecuteExW

user32

AppendMenuW BeginPaint CallWindowProcW CharNextA CharNextW CharPrevW CheckDlgButton CloseClipboard CreateDialogParamW CreatePopupMenu CreateWindowExW DefWindowProcW DestroyWindow DialogBoxParamW DispatchMessageW DrawTextW EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExW GetClassInfoW GetClientRect GetDC GetDlgItem GetDlgItemTextW GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongW GetWindowRect InvalidateRect IsWindow IsWindowEnabled IsWindowVisible LoadCursorW LoadImageW MessageBoxIndirectW OpenClipboard PeekMessageW PostQuitMessage RegisterClassW ReleaseDC ScreenToClient SendMessageTimeoutW SendMessageW SetClassLongW SetClipboardData SetCursor SetDlgItemTextW SetForegroundWindow SetTimer SetWindowLongW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TrackPopupMenu wsprintfA wsprintfW

Name

.text

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

224B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

70KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.ndata

Size

512B

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/System.dll

IMPHASH 54155049a863dad02f4bb5d56b2ac8d0
SHA256 db6b3d7276c551221d55520dfc94acc175d2dcd7370ade38a667bf0fdf6a9cfa
MD5 d04a06a05a6aee6b49baf107edc1eebb
SHA1 7c74c9317588dcb9004746d288caa82cf788c0ff
SHA512 3e7ce0e10164f1c80df102066cf2338498fa0e35f425abfb698a1a1dc95c1bb6460e2e5c2c53a7a5d3843bb4480308cca35ad23e852c28cc9731941b85ba6c88
SSDEEP 768:0S7Mk5dmwtmKInwop3Rrxv8UeqYFahSTmB9K:z7Mk5d5mKIRpBqUeqyfk
TLSH
T135D2190AFA42CCF3D072D67488CBF63789166D3AA72A4677FE6F4E197C27650590D102
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12945

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

179B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsDialogs.dll

IMPHASH c442f1649aa0670a32c622fadfcd00bd
SHA256 5683357273097ca8641a98e3590e4e7b75c972e1063299a1429abdee2d2b18d5
MD5 b6c7dc4ef7032f11ecf005eea0724655
SHA1 059e5da3c9458cbe95f458f139c23f04c20b16c1
SHA512 0206f6f8295f02dad7f54dc656a448bdd5fcdd17cf38ca23b024732274e01aa712d8c0975948099c6c5803d946440fa1b53dde29e71bcd1082f61ba20b1ac909
SSDEEP 192:qlWWGk581HwPf5G/QocFR1w5kYkv/RelBBoiE+6SZS7Emk8:ZPk5Sof5G/QocFR6OYkvUlBBoij4T
TLSH
T1A652E50EFB0A44F6C572D831648BE72F869DA415C66B4E06EF170B0CBCA72B5281E745
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8819

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

424B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

363B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

516B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsExec.dll

IMPHASH c3edd09206117610ac78ba82816b607c
SHA256 61f0e47b09316d39979c62a05403a3baa3ee58841dfd97cc00fb4dc086843815
MD5 aac4f3facf83975d0cf2b02200ae8212
SHA1 8ea89129df40923951610b6f003c10ab7c5cb238
SHA512 b0d4a5f2c129ac39e55ee20ffcf8fe1306b0ba791ec9ade8249a3304e091941476a032089e22a7e1ffb709f6e0a591d026091707754a387e147fcc6af996336a
SSDEEP 192:CCtx8+SjrhYnUMu3Oad9z3Ykv/RWwCh3srduaO4:vx8+SvhYnBu3Oad9z3YkvcwCh3srdu
TLSH
T17B2296C9BB0579F5D0639934B18AF12F4DA97C31CA2B840EE89A1E35B82F5E4571DB03
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4671

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

236B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

108B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

320B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SeaghostShield.exe

IMPHASH 8a34d2e5912e3d13caec44729685a874
SHA256 ab3dc33bb3bb80944211ecdcc94bd810ddd9ea8a2444a8a875d22ac5415afac8
MD5 45c4343afd59f5cb2adb608b548a89ac
SHA1 0b2a92a8dccfa40c267dbb4ef3939595041a21f5
SHA512 29d088b6211b1147cc4f20b119a9b39fcebd1c1be9cd647221271aebf5711dd42cc0bb75f42f09be3955795d6165c900f4b908482ba7e2b6f44e252655410f0c
SSDEEP 1572864:keryp+4F4AndVy2UmXrYGG1rallkcRfASAXF:keG2kryTWr/G1ekq5OF
TLSH
T14AC71256E2FD01E8D47AC0B8C6574617EBB234551334ABEB22A48A252F37FE16E7D310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6067232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\src\runtime\artifacts\obj\coreclr\windows.x64.Release\Corehost.Static\singlefilehost.pdb

kernel32

ActivateActCtx FindResourceW GetWindowsDirectoryW GetModuleHandleW LoadLibraryExW LoadLibraryExA RtlCaptureContext WideCharToMultiByte GetConsoleOutputCP MapViewOfFileEx SetLastError SetThreadErrorMode RaiseException SetConsoleCtrlHandler DebugBreak FlsAlloc FlsSetValue FlsGetValue GetLocaleInfoEx GetUserDefaultLocaleName FlushProcessWriteBuffers ReadFile CreateNamedPipeA GetCurrentProcess WriteFile WaitForMultipleObjects WaitForSingleObject DuplicateHandle DisconnectNamedPipe CreateEventW CreateFileA CancelIoEx GetOverlappedResult ConnectNamedPipe FlushFileBuffers SetEvent ResetEvent WaitForSingleObjectEx VirtualAlloc VirtualFree VirtualQuery VirtualProtect SleepEx SwitchToThread MultiByteToWideChar SuspendThread ResumeThread LCMapStringEx FormatMessageW LocalFree GetModuleFileNameW GetEnvironmentVariableW CreateFileW GetFullPathNameW HeapAlloc HeapFree CreateFileMappingW HeapCreate GetProcessHeap HeapDestroy VerSetConditionMask VerifyVersionInfoW QueueUserAPC SetThreadPriority GetThreadPriority TlsSetValue TlsAlloc WaitForMultipleObjectsEx SignalObjectAndWait RtlLookupFunctionEntry SetThreadStackGuarantee LocateXStateFeature SetErrorMode RaiseFailFastException GetExitCodeProcess TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter AddVectoredExceptionHandler GetThreadContext SetThreadContext GetEnabledXStateFeatures InitializeContext RtlRestoreContext SetXStateFeaturesMask CopyContext GetModuleHandleExW GetCommandLineW CreateProcessW GetCPInfo ExitProcess OutputDebugStringW RtlInstallFunctionTableCallback GetLogicalProcessorInformationEx SetThreadGroupAffinity GetThreadGroupAffinity UnmapViewOfFile GetProcessAffinityMask QueryInformationJobObject FlushInstructionCache RtlDeleteFunctionTable AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock InitializeConditionVariable WakeAllConditionVariable AcquireSRWLockShared SleepConditionVariableSRW ReleaseSRWLockShared CreateMemoryResourceNotification WerRegisterRuntimeExceptionModule RtlUnwind CloseThreadpoolTimer CreateThreadpoolTimer SetThreadpoolTimer OpenEventW ExitThread HeapReAlloc TlsGetValue GetFileSize RtlAddFunctionTable CreateSemaphoreExW ReleaseSemaphore GetSystemDefaultLCID GetUserDefaultLCID OutputDebugStringA QueryThreadCycleTime SetFilePointer MapViewOfFile Sleep RemoveDirectoryW CreateDirectoryW GetEnvironmentStringsW GetSystemTime GetSystemTimeAsFileTime FreeLibrary GetCurrentProcessId GetProcAddress CreateThread GetSystemInfo CloseHandle GetActiveProcessorGroupCount GetCurrentThread GetLastError FreeEnvironmentStringsW GetCurrentThreadId CreateActCtxW GetStdHandle FindNextFileW EnterCriticalSection FindFirstFileExW GetFileSizeEx InitializeCriticalSection GetTempPathW FindClose GetFileAttributesW GetConsoleMode GetFileAttributesExW LoadLibraryA GetCurrentDirectoryW WriteConsoleW DeleteCriticalSection CreateFileMappingA LeaveCriticalSection GetTickCount64 QueryPerformanceFrequency QueryPerformanceCounter IsDebuggerPresent GetNumaHighestNodeNumber SetThreadAffinityMask SetThreadIdealProcessorEx GetThreadIdealProcessorEx VirtualAllocExNuma GetNumaProcessorNodeEx VirtualUnlock GetLargePageMinimum IsProcessInJob K32GetProcessMemoryInfo GetLogicalProcessorInformation GlobalMemoryStatusEx RtlVirtualUnwind IsProcessorFeaturePresent InitializeSListHead RtlUnwindEx RtlPcToFileHeader EncodePointer InitializeCriticalSectionAndSpinCount TlsFree TryAcquireSRWLockExclusive GetExitCodeThread GetStringTypeW InitializeCriticalSectionEx DecodePointer SetEnvironmentVariableW GetProcessGroupAffinity GetCurrentProcessorNumberEx

advapi32

LookupPrivilegeValueW RegGetValueW SetKernelObjectSecurity RegQueryValueExW RegOpenKeyExW GetSidSubAuthorityCount GetSidSubAuthority GetTokenInformation OpenProcessToken RegCloseKey SetThreadToken RevertToSelf OpenThreadToken EventWrite EventRegister EventWriteTransfer DeregisterEventSource RegisterEventSourceW ReportEventW AdjustTokenPrivileges

ole32

CLSIDFromProgID CoCreateGuid CoTaskMemAlloc CoUnmarshalInterface CoMarshalInterface CoGetMarshalSizeMax CoCreateFreeThreadedMarshaler CoGetClassObject CoGetContextToken CoGetObjectContext CoReleaseMarshalData CoInitializeEx CoRegisterInitializeSpy CoWaitForMultipleHandles CoUninitialize CoRevokeInitializeSpy CoTaskMemFree

oleaut32

SetErrorInfo GetErrorInfo SysFreeString SysStringLen CreateErrorInfo QueryPathOfRegTypeLi LoadTypeLibEx SafeArrayGetVartype VariantChangeType SysAllocString LoadRegTypeLi SysAllocStringLen VariantClear VariantInit VarCyFromDec SafeArrayDestroy SafeArrayAllocDescriptorEx GetRecordInfoFromTypeInfo SafeArraySetRecordInfo SafeArrayAllocData SafeArrayGetElemsize SysStringByteLen SysAllocStringByteLen SafeArrayCreateVector SafeArrayPutElement SafeArrayGetDim SafeArrayGetLBound

user32

MessageBoxW LoadStringW

shell32

ShellExecuteW

api-ms-win-crt-string-l1-1-0

iswspace strncpy iswascii _strnicmp iswupper strncmp strncpy_s towlower wcscat_s _wcsdup wcscpy_s wcsncpy_s isalpha strnlen wcsncat_s strncat_s towupper strcpy_s strcmp _stricmp strcat_s isspace tolower wcsncmp _strdup strtok_s wcsnlen strlen _wcsnicmp _wcsicmp isdigit

api-ms-win-crt-heap-l1-1-0

_callnewh realloc _aligned_malloc malloc _set_new_mode free calloc _aligned_free

api-ms-win-crt-convert-l1-1-0

atoi atol _wcstoui64 strtol _wtoi _ltow_s strtoull strtoul wcstoul _atoi64

api-ms-win-crt-stdio-l1-1-0

fputwc __stdio_common_vsprintf_s _set_fmode __stdio_common_vfprintf __acrt_iob_func __p__commode ftell fseek __stdio_common_vsprintf fopen __stdio_common_vfwprintf setvbuf _setmode _dup _fileno fclose __stdio_common_vswprintf _flushall fwrite __stdio_common_vsnwprintf_s __stdio_common_vsnprintf_s _wfsopen _write __stdio_common_vsscanf fgets fflush fputs _wfopen

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-runtime-l1-1-0

_invoke_watson _invalid_parameter_noinfo _wcserror_s _beginthreadex abort _register_thread_local_exe_atexit_callback _c_exit __p___wargv __p___argc _errno _exit exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table terminate _controlfp_s

api-ms-win-crt-filesystem-l1-1-0

_wremove _wrename

api-ms-win-crt-math-l1-1-0

truncf ilogbf copysignf copysign ceilf round asinh cbrt cos acosh atanh modf acoshf cbrtf atanhf modff asinhf _fdopen fmodf fmod tanhf fmaf fma floorf __setusermatherr acos acosf asin asinf atan atan2 atan2f log10 log10f log2 log2f logf floor expf pow log powf exp coshf roundf cosh sin sinf cosf sinh sinhf trunc sqrt sqrtf tan tanf tanh atanf ceil

api-ms-win-crt-time-l1-1-0

_gmtime64_s _time64 wcsftime

api-ms-win-crt-locale-l1-1-0

_create_locale __pctype_func ___mb_cur_max_func ___lc_codepage_func _configthreadlocale setlocale _lock_locales _unlock_locales _free_locale ___lc_locale_name_func

Name

.text

Size

6.4MB

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.CLR_UEF

Size

512B

Virtual Size

215B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

229KB

Virtual Size

228KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Section

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SeaghostShield-Setup.exe

advapi32

comctl32

gdi32

kernel32

ole32

shell32

user32

generic

$PLUGINSDIR/System.dll

kernel32

msvcrt

ole32

user32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

comdlg32

gdi32

kernel32

ole32

shell32

user32

generic

$PLUGINSDIR/nsExec.dll

advapi32

kernel32

user32

generic

SeaghostShield.exe

kernel32

advapi32

ole32

oleaut32

user32

shell32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic