AOTools-Setup-1[.]0[.]1[.]263[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
AOTools-Setup-1.0.1.263.exe
Size 11.3MB
Sample261006-pg3bzagt4w
SHA256 1dbb3faf3ec79870f092e6439505d892e92098d5e3c1247ec9d480388bb543be
MD5 bc8d39684fdea2439b6ceab503e97284
SHA1 00cddabbcf93e1b137efc4127861247903bb9d29
SHA512 0eb4346a027ce3c1764edaf815591c91883fc0bc6876ca5300d0c1dcc25fe89ce647069461f7587b09c7910e2b8bbf9aec552cc38f62bcd0e34676ec9f45734f
SSDEEP 196608:RWEXAiwPSoK9i4qyxXiRhxxi/sz27R0PIVmh0O3x99mCJj8bOh+FcA:RBSP7K+FxZz290PLuRCJ8ka5
TLSH
T110C6339DE7B4E386E1980D3D62E10DDBB90B59781164C30BF848D86EACC567BC17227E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://npcap.com/dist/npcap-1.89.exe

Signatures

Unsigned PE 9 IoCs

Checks for missing Authenticode signature.

resource
AOTools-Setup-1.0.1.263.exe
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/payload/AOGSequenceBridge.dll
unpack001/$PLUGINSDIR/payload/AOGSequenceProbe.exe
unpack001/$PLUGINSDIR/payload/AOTools-Updater.exe
unpack001/$PLUGINSDIR/payload/AOTools.exe
unpack001/$PLUGINSDIR/payload/AoG-Tools.exe

File Explorer

AOTools-Setup-1.0.1.263.exe

.exe 11.3MB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/npcap_free_download.ps1

.ps1 1KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsExec.dll

.dll 7KB
$PLUGINSDIR/payload/AOGSequenceBridge.dll

.dll 441KB
$PLUGINSDIR/payload/AOGSequenceProbe.exe

.exe 702KB
$PLUGINSDIR/payload/AOTools-Updater.exe

.exe 1.0MB
$PLUGINSDIR/payload/AOTools.exe

.exe 21.2MB
$PLUGINSDIR/payload/AoG-Tools.exe

.exe 396KB

AOTools-Setup-1.0.1.263.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 1dbb3faf3ec79870f092e6439505d892e92098d5e3c1247ec9d480388bb543be
MD5 bc8d39684fdea2439b6ceab503e97284
SHA1 00cddabbcf93e1b137efc4127861247903bb9d29
SHA512 0eb4346a027ce3c1764edaf815591c91883fc0bc6876ca5300d0c1dcc25fe89ce647069461f7587b09c7910e2b8bbf9aec552cc38f62bcd0e34676ec9f45734f
SSDEEP 196608:RWEXAiwPSoK9i4qyxXiRhxxi/sz27R0PIVmh0O3x99mCJj8bOh+FcA:RBSP7K+FxZz290PLuRCJ8ka5
TLSH
T110C6339DE7B4E386E1980D3D62E10DDBB90B59781164C30BF848D86EACC567BC17227E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 68b7023f8923dd087549802f8fa631c3
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/payload/AOGSequenceBridge.dll

IMPHASH 71a9c5684a8f1b2755ffdb74c82266bb
SHA256 0866b8cf5ae02b0482c890c409e3ec35b90c91a3434a3e7be1a4fa806ab75edf
MD5 3bfd74f085a346905b8e5358f755dc54
SHA1 b9d481ba193910a06bdbcd6f355b1afb763d694c
SHA512 723b26da3457d1bd45b57b84dcf9c0999747f9e1c60918dddc490c2f8213cc692c0df96093796b818dc5d276beedc2d66b1c1fc3174a220741813e3706bba60c
SSDEEP 12288:YI1NgArU8xx4Df9pe5l6+wSaayFgKSj23noG9gybgmDdX7:Y9f984SaJU27
TLSH
T1CCA47B44EB9B64B5F41E6575728F723F9D69061023A1CCF7CFC68E6018235E22E77A0A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16976

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

AOGSequenceBridge.pdb

user32

CallNextHookEx KillTimer RegisterWindowMessageW SetTimer wsprintfW

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p___wargv _beginthreadex _configure_narrow_argv _configure_wide_argv _crt_at_quick_exit _crt_atexit _errno _execute_onexit_table _exit _initialize_narrow_environment _initialize_onexit_table _initialize_wide_environment _initterm _register_onexit_function abort

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf __stdio_common_vsprintf_s __stdio_common_vswprintf fflush fputc fwrite

api-ms-win-crt-string-l1-1-0

iswctype isxdigit strcmp strlen strncmp strncpy_s wcslen

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared CloseHandle DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection FlsAlloc FlsGetValue FlsSetValue GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetLocalTime GetModuleHandleExW GetModuleHandleW GetSystemTimePreciseAsFileTime GetThreadId GetTickCount64 InitOnceExecuteOnce InitializeCriticalSection K32EnumProcessModules LeaveCriticalSection MapViewOfFile MultiByteToWideChar OpenFileMappingW QueryPerformanceCounter QueryPerformanceFrequency ReadProcessMemory ReleaseSRWLockExclusive ReleaseSRWLockShared RtlCaptureStackBackTrace Sleep SleepConditionVariableSRW SwitchToThread TlsGetValue TryAcquireSRWLockExclusive TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte

api-ms-win-crt-environment-l1-1-0

__p__environ __p__wenviron

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-time-l1-1-0

__daylight __timezone __tzname _tzset

api-ms-win-crt-private-l1-1-0

memchr

api-ms-win-crt-convert-l1-1-0

strtod strtof strtol strtoll strtoul strtoull wcstod wcstol wcstoul

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func localeconv

Name

.text

Size

321KB

Virtual Size

320KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

74B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.eh_fram

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gcc_exc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

66B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/33

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/46

Size

1024B

Virtual Size

591B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/58

Size

512B

Virtual Size

255B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/payload/AOGSequenceProbe.exe

IMPHASH 8742415eb99e000c611157a0443d2663
SHA256 a19780d0207f54918234d53ba4493ba522fd3af684e9260f2591c68cb8645598
MD5 5e26f9eee0e1063eff188061d65975bc
SHA1 ea0ae22257cbee04029e578c3f658b3201100847
SHA512 7982cbb7ee974cf7d40abab9b459b8fd835d75bf3676b43ce8d2bcb39a600fa0c3b007756c97a4f49901b74ba03d2c54bdd1f90d0589d8e6ae83bd35600a0e08
SSDEEP 12288:kype4l6+8o72GNBqvHujKG+H7n7tsjOPp7sBtnb628LEzuWgP7/i+qCP4/+NAcbO:ky8Po7mxsjOP2Btnbx8LEzu2MsxlDRNF
TLSH
T1DEE48C49FBEB61B8F86615B462AF733AC93906108365CCE7CBD15F9018226D11FB321B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4368

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

AOGSequenceProbe.pdb

user32

CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EnableWindow EnumWindows GetForegroundWindow GetMessageW GetWindow GetWindowTextW GetWindowThreadProcessId IsIconic IsWindow IsWindowVisible KillTimer LoadCursorW MessageBoxW PostMessageW PostQuitMessage RegisterClassW RegisterWindowMessageW SendMessageW SetTimer SetWindowTextW SetWindowsHookExW ShowWindow TranslateMessage UnhookWindowsHookEx wsprintfW

gdi32

GetStockObject

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptOpenAlgorithmProvider

shell32

CommandLineToArgvW

ws2_32

WSACleanup WSAGetLastError WSAStartup closesocket connect getsockopt htons inet_pton ioctlsocket recv select send socket

api-ms-win-crt-convert-l1-1-0

_strtod_l _strtoi64_l _strtoui64_l mbrtowc mbsrtowcs strtod strtof strtol strtoll strtoul strtoull wcrtomb wcrtomb_s wcstod wcstol wcstoul

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p___wargv __p__wcmdln __sys_nerr _beginthreadex _cexit _configure_narrow_argv _configure_wide_argv _crt_at_quick_exit _crt_atexit _errno _exit _fpreset _initialize_narrow_environment _initialize_wide_environment _initterm _set_app_type _set_invalid_parameter_handler abort exit signal strerror_s

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf __stdio_common_vsprintf_s __stdio_common_vsscanf __stdio_common_vswprintf _wfopen fclose fflush fopen fputc fread fseek ftell fwrite

api-ms-win-crt-string-l1-1-0

_isctype_l _iswalpha_l _iswcntrl_l _iswdigit_l _iswlower_l _iswprint_l _iswpunct_l _iswspace_l _iswupper_l _iswxdigit_l _strcoll_l _strdup _strxfrm_l _tolower_l _toupper_l _towlower_l _towupper_l _wcscoll_l _wcsicmp _wcsxfrm_l iswctype isxdigit mbrlen strcmp strlen strncmp tolower toupper wcslen

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared CloseHandle CopyFileW CreateFileMappingW CreateFileW CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW EnterCriticalSection FlsAlloc FlsGetValue FlsSetValue FreeLibrary GetCommandLineW GetCurrentProcess GetCurrentThreadId GetExitCodeProcess GetLastError GetLocalTime GetModuleFileNameW GetProcAddress GetProcessIdOfThread GetStartupInfoW GetSystemInfo GetSystemTime GetSystemTimePreciseAsFileTime GetThreadId GetTickCount64 GetTickCount InitOnceExecuteOnce InitializeCriticalSection K32EnumProcessModules LeaveCriticalSection LoadLibraryW LocalFree MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar OpenEventW OpenProcess OpenThread Process32FirstW Process32NextW QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency ReadProcessMemory ReleaseSRWLockExclusive ReleaseSRWLockShared SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread TlsGetValue TryAcquireSRWLockExclusive TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte

api-ms-win-crt-math-l1-1-0

__setusermatherr frexp pow

api-ms-win-crt-environment-l1-1-0

__p__environ __p__wenviron

api-ms-win-crt-time-l1-1-0

__daylight __timezone __tzname _strftime_l _tzset

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func __pctype_func _configthreadlocale _create_locale _free_locale localeconv setlocale

api-ms-win-crt-multibyte-l1-1-0

_mbtowc_l

api-ms-win-crt-private-l1-1-0

memchr

Name

.text

Size

503KB

Virtual Size

503KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

61KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

73B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.eh_fram

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gcc_exc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

66B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/33

Size

512B

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/46

Size

1024B

Virtual Size

591B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/58

Size

512B

Virtual Size

255B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/payload/AOTools-Updater.exe

IMPHASH f0ad4639bef0553bfa46266b6e1b4260
SHA256 8ce832264f281c703aac8926223b8ef8a864ee4f3d14209b1288ca1ad3a36e25
MD5 194bcca64e4ca288268e99dbe0f52e11
SHA1 253bf218cfdf67711fde486bbf84aa7110032c6d
SHA512 6d4e746dd1c024bc220b8cae1d67fca18c08e2a414ec63164a8996f3935e49102aa9154a6905184027681ed6eb096ca6c40af8f94e1997f94d0a8ab5ae55edcf
SSDEEP 12288:oSHjRWUtczOlaFLDMbV6iwTR4/DdT0S+dAHo5ngE/BO0LXt4bCJKnAt2peQ3UtEh:iliw2dT0S+2KXtHkpevcT
TLSH
T11A258E1732B1D2F8C96AC038634795559F317C8D03A4ACEF069116702DABAFA4F7B62D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

102064

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

AOTools-Updater.pdb

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptOpenAlgorithmProvider

shell32

CommandLineToArgvW SHGetFolderPathW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

ole32

CoCreateInstance CoInitializeEx CoUninitialize

advapi32

RegCloseKey RegCreateKeyExW RegDeleteKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW

api-ms-win-crt-convert-l1-1-0

_strtod_l _strtoi64_l _strtoui64_l mbrtowc mbsrtowcs strtod strtof strtol strtoll strtoul strtoull wcrtomb wcrtomb_s wcstod wcstol wcstoul

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func __pctype_func _configthreadlocale _create_locale _free_locale localeconv setlocale

api-ms-win-crt-private-l1-1-0

__C_specific_handler memchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv __p__wcmdln __sys_nerr _beginthreadex _cexit _configure_wide_argv _crt_atexit _errno _exit _initialize_wide_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal strerror_s

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf __stdio_common_vswprintf _close _get_osfhandle _wfopen _wopen fclose fflush fopen fputc fread fseek ftell fwrite setbuf

api-ms-win-crt-string-l1-1-0

_isctype_l _iswalpha_l _iswcntrl_l _iswdigit_l _iswlower_l _iswprint_l _iswpunct_l _iswspace_l _iswupper_l _iswxdigit_l _strcoll_l _strdup _strxfrm_l _tolower_l _toupper_l _towlower_l _towupper_l _wcscoll_l _wcsicmp _wcsxfrm_l iswctype mbrlen strcmp strlen strncmp tolower toupper wcscmp wcscpy wcslen wcsncmp

kernel32

AcquireSRWLockExclusive AreFileApisANSI CloseHandle CreateDirectoryW CreateFileW CreateHardLinkW CreateProcessW CreateSymbolicLinkW DeleteCriticalSection DeviceIoControl EnterCriticalSection FindClose FindFirstFileW FindNextFileW FlsAlloc FlsGetValue FlsSetValue GetCommandLineW GetCurrentDirectoryW GetCurrentThreadId GetDiskFreeSpaceExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetLastError GetStartupInfoW GetSystemTime GetSystemTimePreciseAsFileTime GetTempPathW GetThreadId GetTickCount64 InitOnceExecuteOnce InitializeCriticalSection LeaveCriticalSection LocalFree MoveFileExW MultiByteToWideChar OpenProcess QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryW SetEndOfFile SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread TerminateProcess TlsGetValue TryAcquireSRWLockExclusive TryEnterCriticalSection VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte

user32

MessageBoxW

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen

api-ms-win-crt-environment-l1-1-0

__p__wenviron

api-ms-win-crt-time-l1-1-0

_strftime_l

api-ms-win-crt-multibyte-l1-1-0

_mbtowc_l

Name

.text

Size

730KB

Virtual Size

729KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

251KB

Virtual Size

250KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

100B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/payload/AOTools.exe

IMPHASH e1f9d00b88b8a8c61a7cb138c17b094d
SHA256 c6560abf01b93cb8fb8b5c02b8b1eee224133729d2a387fd551c8514acf2dad5
MD5 cec6d47f7410810241cb46ebfa0192e4
SHA1 c892c2942d337b5581b248f2f27d629bb88c18d8
SHA512 26f7ebcde998a70161e26e59c55c67a49a26d2e703fb5c3e29c4cf98663d7b3934ecb2798a65ae7a44a9cfa958a4855396de425d7ab971ec06d190d071e3c8fb
SSDEEP 393216:q1UZmMIiA3GH21iLd0IA5Kz+e/WETqYRE+:GUsMaWO4mImgB/WhYW+
TLSH
T1B427C07BF3D12277EDE3037A564D44F1ED3C7119932450EA98AD96383686A3E927023E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1677792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

AOTools.pdb

comctl32

DefSubclassProc GetWindowSubclass InitCommonControlsEx RemoveWindowSubclass SetWindowSubclass

comdlg32

GetOpenFileNameW GetSaveFileNameW

shell32

CommandLineToArgvW SHChangeNotify SHCreateDirectoryExW SHGetFolderPathW ShellExecuteW

advapi32

CredDeleteW CredFree CredReadW CredWriteW RegCloseKey RegCopyTreeW RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptGetProperty BCryptHashData BCryptOpenAlgorithmProvider

dwmapi

DwmSetWindowAttribute

uxtheme

SetWindowTheme

ole32

CoCreateGuid CoCreateInstance CoInitializeEx CoUninitialize CreateStreamOnHGlobal StringFromGUID2

gdi32

AddFontMemResourceEx BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontIndirectW CreateFontW CreatePen CreateSolidBrush DeleteDC DeleteObject Ellipse GetCurrentObject GetObjectW GetStockObject GetTextExtentPoint32W GetTextMetricsW IntersectClipRect LineTo MoveToEx Rectangle RemoveFontMemResourceEx RemoveFontResourceExW RestoreDC SaveDC SelectObject SetBkColor SetBkMode SetTextAlign SetTextCharacterExtra SetTextColor TextOutW

gdiplus

GdipAddPathArc GdipAddPathArcI GdipAlloc GdipBitmapGetPixel GdipBitmapLockBits GdipBitmapSetPixel GdipBitmapUnlockBits GdipCloneBitmapAreaI GdipCloneBrush GdipCloneImage GdipClosePathFigure GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipCreateFromHDC GdipCreateImageAttributes GdipCreatePath GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipDeleteGraphics GdipDeletePath GdipDeletePen GdipDisposeImage GdipDisposeImageAttributes GdipDrawArc GdipDrawArcI GdipDrawEllipse GdipDrawEllipseI GdipDrawImageRect GdipDrawImageRectI GdipDrawImageRectRect GdipDrawLine GdipDrawLineI GdipDrawLines GdipDrawPath GdipDrawPolygon GdipDrawRectangle GdipDrawRectangleI GdipFillEllipse GdipFillPath GdipFillRectangle GdipFlush GdipFree GdipGetImageHeight GdipGetImageWidth GdipSetCompositingMode GdipSetImageAttributesColorMatrix GdipSetInterpolationMode GdipSetPenEndCap GdipSetPenLineJoin GdipSetPenStartCap GdipSetPixelOffsetMode GdipSetSmoothingMode GdiplusShutdown GdiplusStartup

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts

user32

AdjustWindowRectEx BeginPaint BringWindowToTop CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW DrawFocusRect DrawTextW EnableWindow EndPaint EnumChildWindows EnumDisplayMonitors EnumThreadWindows EnumWindows FillRect FrameRect GetClassNameW GetClientRect GetCursorPos GetDC GetDlgCtrlID GetDlgItem GetForegroundWindow GetKeyState GetMessageW GetMonitorInfoW GetParent GetPropW GetScrollInfo GetSystemMetrics GetWindow GetWindowLongPtrW GetWindowRect GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId InflateRect IntersectRect InvalidateRect IsDialogMessageW IsIconic IsWindow IsWindowEnabled IsWindowVisible KillTimer LoadCursorW LoadIconW LoadImageW MapWindowPoints MessageBoxW MonitorFromPoint MoveWindow OffsetRect PostMessageW PostQuitMessage PtInRect RedrawWindow RegisterClassExW RegisterClassW ReleaseDC ScreenToClient SendMessageW SetActiveWindow SetCursor SetFocus SetForegroundWindow SetProcessDPIAware SetPropW SetScrollInfo SetTimer SetWindowLongPtrW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TrackMouseEvent TranslateMessage UnionRect UpdateWindow

shlwapi

SHCreateMemStream

xmllite

CreateXmlReader

crypt32

CryptBinaryToStringW

api-ms-win-crt-convert-l1-1-0

_strtod_l _strtoi64_l _strtoui64_l _wtoi mbrtowc mbsrtowcs strtod strtof strtol strtoll strtoul strtoull wcrtomb wcrtomb_s wcstod wcstol wcstoul

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func __pctype_func _configthreadlocale _create_locale _free_locale localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen lroundf

api-ms-win-crt-private-l1-1-0

__C_specific_handler __intrinsic_setjmpex longjmp memchr

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsprintf_s __stdio_common_vsscanf __stdio_common_vswprintf __stdio_common_vswprintf_s _close _get_osfhandle _wfopen _wopen fclose fflush fopen fputc fread fseek ftell fwrite setbuf

api-ms-win-crt-string-l1-1-0

_isctype_l _iswalpha_l _iswcntrl_l _iswdigit_l _iswlower_l _iswprint_l _iswpunct_l _iswspace_l _iswupper_l _iswxdigit_l _strcoll_l _strdup _strxfrm_l _tolower_l _toupper_l _towlower_l _towupper_l _wcscoll_l _wcsicmp _wcsxfrm_l isspace iswalnum iswctype mbrlen strcmp strlen strncmp tolower toupper towlower wcscmp wcscpy wcslen wcsncmp wcsncpy

kernel32

AcquireSRWLockExclusive AreFileApisANSI CloseHandle CompareFileTime CompareStringOrdinal CopyFileW CreateDirectoryW CreateFileW CreateHardLinkW CreateProcessW CreateSymbolicLinkW CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DeviceIoControl EnterCriticalSection FindClose FindFirstFileW FindNextFileW FindResourceW FlsAlloc FlsGetValue FlsSetValue FlushFileBuffers FreeLibrary GetCommandLineW GetCurrentDirectoryW GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceExW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFinalPathNameByHandleW GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleW GetPrivateProfileIntW GetPrivateProfileStringW GetProcAddress GetStartupInfoW GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempFileNameW GetTempPathW GetThreadId GetTickCount64 GlobalAlloc GlobalFree GlobalLock GlobalUnlock InitOnceExecuteOnce InitializeCriticalSection LeaveCriticalSection LoadLibraryW LoadResource LocalFree LockResource MoveFileExW MulDiv MultiByteToWideChar OpenEventW OpenMutexW OpenProcess OutputDebugStringW Process32FirstW Process32NextW QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSRWLockExclusive ReplaceFileW RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryW SetEndOfFile SetEvent SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TlsGetValue TryAcquireSRWLockExclusive TryEnterCriticalSection VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile WritePrivateProfileStringW

api-ms-win-crt-environment-l1-1-0

__p__wenviron

api-ms-win-crt-time-l1-1-0

_strftime_l

api-ms-win-crt-multibyte-l1-1-0

_mbtowc_l

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

799KB

Virtual Size

799KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

92B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18.2MB

Virtual Size

18.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/payload/AoG-Tools.exe

IMPHASH f35debe1f812708ad9cdde08510661ee
SHA256 20d383302af1a3c21ef3184dddd0d58f0d85fdf7a48fdf9bdeae9368b9873bad
MD5 c6f8d3f763f38c22d1646d72436d199c
SHA1 7d99eeaba405176e0cd2acc626c41392da5a6e4e
SHA512 0b6ad6bb2aed58fc4ea074744107cc435cf55d7c409033390896127256cb886b0edbe54378db450529ecf6145db03b7b2be0de41bdb5f28ba51ba3ed1108dfbb
SSDEEP 6144:LEWSMLuZcMZyq2CbXlXy3IX+Z26Tv1YLAxmWtmp7tJLpT6LqkrhZuAVv9RbqjPLf:R9Lu+wV7q+rp7fJVk7enGK
TLSH
T164847D87E0A195F8D897D03C534BE05199327C5C0350D8EF13966B702EABED29F7BA29
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

AoG-Tools.pdb

user32

MessageBoxW

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-private-l1-1-0

__C_specific_handler memchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv __p__wcmdln _beginthreadex _cexit _configure_wide_argv _crt_atexit _errno _exit _initialize_wide_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vswprintf fflush fputc fwrite

api-ms-win-crt-string-l1-1-0

iswctype strcmp strlen strncmp wcslen

kernel32

AcquireSRWLockExclusive CloseHandle CreateProcessW DeleteCriticalSection EnterCriticalSection FlsAlloc FlsGetValue FlsSetValue GetCurrentThreadId GetExitCodeProcess GetLastError GetModuleFileNameW GetStartupInfoW GetSystemTimePreciseAsFileTime GetThreadId InitOnceExecuteOnce InitializeCriticalSection LeaveCriticalSection MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread TlsGetValue TryAcquireSRWLockExclusive TryEnterCriticalSection VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

__p__wenviron

api-ms-win-crt-convert-l1-1-0

strtod strtof strtol strtoll strtoul strtoull wcstod wcstol wcstoul

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func localeconv

Name

.text

Size

307KB

Virtual Size

307KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

94B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

AOTools-Setup-1.0.1.263.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/npcap_free_download.ps1

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

$PLUGINSDIR/payload/AOGSequenceBridge.dll

user32

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic

$PLUGINSDIR/payload/AOGSequenceProbe.exe

user32

gdi32

bcrypt

shell32

ws2_32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

kernel32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-private-l1-1-0

generic

$PLUGINSDIR/payload/AOTools-Updater.exe

bcrypt

shell32

version

ole32

advapi32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0