bundle.zip
- SHA256 0736f8148c8f889813cf00dbc90fc3029ece508af58d99018498066d20725e51
Overview
overview
5Static
static
3bundle/dum...LL.dll
windows10-2004-x64
5bundle/dum...LL.dll
windows11-ltsc_2024-x64
5bundle/dum....x.dll
windows10-2004-x64
3bundle/dum....x.dll
windows11-ltsc_2024-x64
3bundle/dum...ct.dll
windows10-2004-x64
5bundle/dum...ct.dll
windows11-ltsc_2024-x64
5bundle/dum...v1.dll
windows10-2004-x64
5bundle/dum...v1.dll
windows11-ltsc_2024-x64
5bundle/dum...ee.exe
windows10-2004-x64
3bundle/dum...ee.exe
windows11-ltsc_2024-x64
3ScyllaToIm...m1.vbs
windows10-2004-x64
5ScyllaToIm...m1.vbs
windows11-ltsc_2024-x64
5ScyllaToIm...er.vbs
windows10-2004-x64
5ScyllaToIm...er.vbs
windows11-ltsc_2024-x64
5ScyllaToIm...es.vbs
windows10-2004-x64
5ScyllaToIm...es.vbs
windows11-ltsc_2024-x64
5bundle/dum...64.dll
windows10-2004-x64
1bundle/dum...64.dll
windows11-ltsc_2024-x64
1bundle/dum...64.exe
windows10-2004-x64
1bundle/dum...64.exe
windows11-ltsc_2024-x64
1bundle/dum...86.dll
windows10-2004-x64
3bundle/dum...86.dll
windows11-ltsc_2024-x64
3bundle/dum...86.exe
windows10-2004-x64
3bundle/dum...86.exe
windows11-ltsc_2024-x64
3bundle/eon.exe
windows10-2004-x64
5bundle/eon.exe
windows11-ltsc_2024-x64
5Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bundle/dumper/Plugins/ImpRec_Plugins/Imprec_Wrapper_DLL.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bundle/dumper/Plugins/ImpRec_Plugins/Imprec_Wrapper_DLL.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
bundle/dumper/Plugins/ImpRec_Plugins/PECompact 2.7.x.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
bundle/dumper/Plugins/ImpRec_Plugins/PECompact 2.7.x.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
bundle/dumper/Plugins/PECompact.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
bundle/dumper/Plugins/PECompact.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
bundle/dumper/Plugins/PESpin_x64_v1.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
bundle/dumper/Plugins/PESpin_x64_v1.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
bundle/dumper/Plugins/ScyllaToImprecTree.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
bundle/dumper/Plugins/ScyllaToImprecTree.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
ScyllaToImprecTree/Form1.vbs
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
ScyllaToImprecTree/Form1.vbs
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
ScyllaToImprecTree/Properties/Resources.Designer.vbs
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
ScyllaToImprecTree/Properties/Resources.Designer.vbs
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
ScyllaToImprecTree/Properties/Resources.vbs
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
ScyllaToImprecTree/Properties/Resources.vbs
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
bundle/dumper/Scylla_x64.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
bundle/dumper/Scylla_x64.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
bundle/dumper/Scylla_x64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
bundle/dumper/Scylla_x64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
bundle/dumper/Scylla_x86.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
bundle/dumper/Scylla_x86.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
bundle/dumper/Scylla_x86.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
bundle/dumper/Scylla_x86.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
bundle/eon.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
bundle/eon.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target bundle.zip
- Size 20.7MB
- Sample261024-xtfbzaby4w
- SHA256 0736f8148c8f889813cf00dbc90fc3029ece508af58d99018498066d20725e51
- MD5 096465e71f5d8e776cbc17ef68e97ad2
- SHA1 64cf44925633c8295e9868af5f19e580a7ccb895
- SHA512 bba8d07061c46b3d4476372d2b7262f0e3b9552bd5f3c077b8504154f145a30ca38fe1305bba2f731e9913cd822b3dd479d3aaabbd4d9d4d5af77f46d9bfb7e2
- SSDEEP 393216:cP56wh+42VHzd04O/XVJQ+JMpiiodXGF0zbpwkWarrgtCbPN7cp:cB6ghyHp04Kcg0i5NGwak/rgoJ8
- TLSH T18F2733801DDC2C94D706B5181C99EEAAB79FA369353872477F4D28AC86D6801C2FDD2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 10 IoCs
Checks for missing Authenticode signature.
resource unpack001/bundle/dumper/Plugins/ImpRec_Plugins/Imprec_Wrapper_DLL.dll unpack001/bundle/dumper/Plugins/ImpRec_Plugins/PECompact 2.7.x.dll unpack001/bundle/dumper/Plugins/PECompact.dll unpack001/bundle/dumper/Plugins/PESpin_x64_v1.dll unpack001/bundle/dumper/Plugins/ScyllaToImprecTree.exe unpack001/bundle/dumper/Scylla_x64.dll unpack001/bundle/dumper/Scylla_x64.exe unpack001/bundle/dumper/Scylla_x86.dll unpack001/bundle/dumper/Scylla_x86.exe unpack001/bundle/eon.exe
File Explorer
-
bundle.zip.zip 20.7MB
-
bundle/dumper/Plugins/ImpRec_Plugins/Imprec_Wrapper_DLL.dll.dll 34KB
-
bundle/dumper/Plugins/ImpRec_Plugins/PECompact 2.7.x.dll.dll 1KB
-
bundle/dumper/Plugins/Include_Headers/ScyllaPlugin.h1KB
-
bundle/dumper/Plugins/PECompact.dll.dll 33KB
-
bundle/dumper/Plugins/PESpin_x64_v1.dll.dll 40KB
-
bundle/dumper/Plugins/ScyllaToImprecTree.exe.exe 11KB
-
bundle/dumper/Plugins/Sources/Imprec_Wrapper_DLL.cpp8KB
-
bundle/dumper/Plugins/Sources/PECompact.cpp4KB
-
bundle/dumper/Plugins/Sources/PESpin_x64_v1.cpp12KB
-
bundle/dumper/Plugins/Sources/scyllatoimprectree.rar.rar 10KB
-
ScyllaToImprecTree.sln876B
-
ScyllaToImprecTree/Form1.Designer.cs3KB
-
ScyllaToImprecTree/Form1.cs3KB
-
ScyllaToImprecTree/Form1.resx.vbs 5KB
-
ScyllaToImprecTree/Program.cs394B
-
ScyllaToImprecTree/Properties/AssemblyInfo.cs1KB
-
ScyllaToImprecTree/Properties/Resources.Designer.cs.vbs 2KB
-
ScyllaToImprecTree/Properties/Resources.resx.vbs 5KB
-
ScyllaToImprecTree/Properties/Settings.Designer.cs1KB
-
ScyllaToImprecTree/Properties/Settings.settings242B
-
ScyllaToImprecTree/ScyllaToImprecTree.csproj3KB
-
ScyllaToImprecTree/app.config.xml 114B
-
bundle/dumper/Scylla.ini447B
-
bundle/dumper/Scylla_Exports.txt5KB
-
bundle/dumper/Scylla_README.txt5KB
-
bundle/dumper/Scylla_x64.dll.dll 507KB
-
bundle/dumper/Scylla_x64.exe.exe 500KB
-
bundle/dumper/Scylla_x64.lib5KB
-
bundle/dumper/Scylla_x64.map423KB
-
bundle/dumper/Scylla_x86.dll.dll 462KB
-
bundle/dumper/Scylla_x86.exe.exe 457KB
-
bundle/dumper/Scylla_x86.lib5KB
-
bundle/dumper/Scylla_x86.map461KB
-
bundle/eon.exe.exe 23.0MB
bundle/dumper/Plugins/ImpRec_Plugins/Imprec_Wrapper_DLL.dll
- IMPHASH 2cc949eb4a30d30d1f52f498bbe8b989
- SHA256 6a51a7e5ce252e01643f6e6d96a4eb15ed162f615a569f1fad157dfced6ffe2b
- MD5 1e4c916c141ce64143cc03d68f340e62
- SHA1 aa3746e5c381b0b9f70fe88d208a7d50f88b060b
- SHA512 c394dcb87c851b7089a1dea56c97de74f7f9642474313aa410f2403b2db33bcded25a3797f5078beab0864489a6ed91b3947e6447f5935641ef5d0489c455ade
- SSDEEP 384:VgsHIA+xpYd8NHGgyvNfUztd9cWcSKfOphwtlwM+1nu6EDHpC676J01wNgvySXmq:V3IPryxUZdylghovmnTEDAJKvySeop
- TLSH T1B3F22A02B69180B7E26E2A3418B996625D7F7C417BF040CB3F9A16F95FB16C0E678317
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
6524
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CreateFileA
SetFilePointer
lstrlenA
MapViewOfFile
UnmapViewOfFile
FreeLibrary
GetCurrentProcess
WriteFile
LoadLibraryW
lstrcatA
GetLastError
GetProcAddress
CreateFileMappingA
GetModuleFileNameA
DuplicateHandle
CloseHandle
OpenFileMappingA
lstrcpyW
HeapSize
GetStringTypeW
GetCurrentThreadId
DecodePointer
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
InterlockedDecrement
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
HeapReAlloc
GetModuleFileNameW
RtlUnwind
LCMapStringW
MultiByteToWideChar
IsProcessorFeaturePresent
user32
wsprintfA
Name
.text
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=171, productName=VS2010 build 30319, version=30319,
count=8, id=158, productName=VS2010 build 30319, version=30319,
count=55, id=170, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=73, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
bundle/dumper/Plugins/ImpRec_Plugins/PECompact 2.7.x.dll
- IMPHASH ff22697165d98bb65eb88dc24cc02224
- SHA256 17b5256499d88166833bd2ee98b242d23337659f45bdb9205d15ecb6b784f797
- MD5 117f1a000d87fd4356ae72f198806eac
- SHA1 1a0ce06b77e5da718f9c3653abefee337d365336
- SHA512 74f4a10abfb02ba037ef3b545d3bff774c79a75f9c8ea6d50a6967b60f9901a0b3b6e9b36cdc2c7b20b54a7a3324548327652b4dcb83db348fda24514522113f
- TLSH T1CB31AC2BD7550973CA091F748A83831DA1B7607116C1A0044BC499686C6968BFD71F22
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
IsBadReadPtr
MapViewOfFile
UnmapViewOfFile
CloseHandle
Trace
Name
.text
Size
188B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
228B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20B
Virtual Size
28B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
bundle/dumper/Plugins/Include_Headers/ScyllaPlugin.h
- SHA256 280c7b2037d4865781177bfeea074b7d90b292751c878012f38e178ded7b79a5
- MD5 18b808ddedc4cfbe43d0a25f9e190321
- SHA1 9f150caaad6ee12983819db0c0ef858e753ea2c5
- SHA512 e6e1a5dadade6e51b39b5b37602cbbd6c5f4dc824133564e32b2e38496221df4ebec37b1126ff2892d0b1e9cd245b113181aad88d602e32868a60223da7a0ea6
- TLSH T14E31000A2F0633760A52EA1A537A708124DB829B8599D71CB07EB7112FE7CD094F3DCC
- MD5 SHA1 SHA512 TLSH
bundle/dumper/Plugins/PECompact.dll
- IMPHASH 975af53aefe81e8a738538bdcad22789
- SHA256 cb358ad5b464dce7b102417dd3e14389e11b591593a62e3e1b80fa1c4453ecc9
- MD5 0111537a291bb6bf633f33ee41236f5b
- SHA1 5b4a19344e62e608fed7dc31a961d67b9733f9c4
- SHA512 f151e764e5f84d9e35cf0896d9f62643d5afdce7c56fd24fe993178f1cbe12d905cdeaa59a570511e20ada69e87db1280c5e8e61d1ba4c2e45d4789e52ac3290
- SSDEEP 384:NI4s0r/dwgGaSPbfu6UXSgcL8dXQrkhU80lHrpeu+1nu6EDHvlvo1/NqvyjsCH:z7SzfHU1cLWIkhDsZmnTED9vlvyIC
- TLSH T1F6E21A0172A184B7E1AA1A3458B5A2715D7F7C0167F040CF3F9A16BE5FB06D0EA7C366
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
4698
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CreateFileA
SetFilePointer
lstrlenA
MapViewOfFile
UnmapViewOfFile
WriteFile
lstrcatA
GetModuleFileNameA
CloseHandle
OpenFileMappingA
GetCurrentThreadId
DecodePointer
GetCommandLineA
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
GetLastError
InterlockedDecrement
GetProcAddress
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
HeapReAlloc
LoadLibraryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
GetModuleFileNameW
RtlUnwind
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapSize
IsProcessorFeaturePresent
ScyllaPluginNameW
Name
.text
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=171, productName=VS2010 build 30319, version=30319,
count=8, id=158, productName=VS2010 build 30319, version=30319,
count=55, id=170, productName=VS2010 build 30319, version=30319,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=69, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
bundle/dumper/Plugins/PESpin_x64_v1.dll
- IMPHASH 1c111dfbeaca7d25a4d7a0291a58856c
- SHA256 e183ebb99dfc7a8d6a8de614158634b00a6527fa5ad440722c6b5cf0a1a43473
- MD5 e851afbadc38a673a7e7cbc232c8bef5
- SHA1 1db930e3f51a4b3e7fb1ffc0ecd543241d44e94d
- SHA512 7ec97409f3197676d19ca2bf5a231d3d1967a11f266adfb243b1f9f6fda43938bbe6e138342cac9a6ac05ee6b5a4d6a72233c1d21a9d6e32f81aa87f324b216b
- SSDEEP 768:bEEAODltRD4njn7oNj7TF0KTClxCTn5f+7nzggXjkDLEHY73uigN:bEEdDltKoFTFH6CTB+7zXMDa
- TLSH T166132A5A22B400B9E5634339CCF38E55E673F84663B5438F869882AE1FB37D65538732
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
6688
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
CreateFileA
SetFilePointer
lstrlenA
MapViewOfFile
UnmapViewOfFile
WriteFile
lstrcatA
GetProcAddress
DisableThreadLibraryCalls
GetModuleFileNameA
CloseHandle
OpenFileMappingA
GetStringTypeW
MultiByteToWideChar
GetCurrentThreadId
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
EncodePointer
FlsGetValue
FlsFree
SetLastError
GetLastError
FlsAlloc
HeapFree
Sleep
GetModuleHandleW
ExitProcess
DecodePointer
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
HeapReAlloc
LoadLibraryW
GetModuleFileNameW
LCMapStringW
HeapSize
user32
wsprintfA
ScyllaPluginNameW
Name
.text
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
444B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=171, productName=VS2010 build 30319, version=30319,
count=51, id=170, productName=VS2010 build 30319, version=30319,
count=6, id=158, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=72, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
bundle/dumper/Plugins/ScyllaToImprecTree.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 883ed0acadc4850439b9f35722b74ff930e39a93f4032c1bfa2a4ac7c9f33812
- MD5 4c70ceb0b6603ae30432a09c42404f1b
- SHA1 ad4d7551e01ea67d11748eb82f9bd8984b36eb28
- SHA512 51528b2ac44763468e46a367f45ade55dbb960fe8be14814d79e787ce1167289d894837ba4d24025529687f98f20071054b213d83f14929410dffecea2edb5bb
- SSDEEP 192:zD2RoZ5Z4b2q0fycIMBB6YSUVrGFuOlMkgyJsO:x5Z4qnRIY7VrGFflMkgyJF
- TLSH T1A9321A2637E89A33D97A4B721CB3914443B2B7564AB5E71E2CCA41CE5CB37184393F62
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17214
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bundle/dumper/Plugins/Sources/Imprec_Wrapper_DLL.cpp
- SHA256 3c816d5b57e9447166ae2956d5b8f099c96f0bf5b34e38514f51e01be8e6f6c5
- MD5 017fc3d70671900804e5d16ede9daf66
- SHA1 5348d47c78409a734e0caed807d5c86e068bb375
- SHA512 28256578a91c5f49c9152110207dc830f31500ddee670b30fea142057667aafc2b75a192bc157d0f7af84a616178ec23fc452b51f149fcb97c3ccf64a1b7d8c0
- SSDEEP 192:EdEGREEEaaSeOyHHC8ONPKIMO65QDHy53J8SpG:qE3XOynPONPKIMO6qry53JnU
- TLSH T171029427764F12A9DF62715C4270088BACBDCD9516E0E7E8FA8F0753E53805581B8DEE
- MD5 SHA1 SHA512 SSDEEP TLSH
bundle/dumper/Plugins/Sources/PECompact.cpp
- SHA256 ecc1c60a1290ff2f27493312aa621451909c54a86ffd91226925f9d7bf824bd0
- MD5 14a3873fe9fefc51475a8bffa74b0972
- SHA1 14d1330e9e5184a2d7e2fd6019f7ea620f2f6a66
- SHA512 20e31a8abecc91aefeb900951ebdc451dceee37af16b0f8c553f1a7add6ccf2a06be6d9c7b8d5bf9b2251581f54f629805330eb4f8cb898733a30b900e4386a6
- SSDEEP 96:JE7TTJjjYHaC//ZkHHCgmevMmJi4+4h18ztpbrEhhch/:JxkHHCgjk14+6Spchhch/
- TLSH T1A791A813B64722689F81F40D4270140FCCE4896995E4A7E9F5CE47E6E37A0A694F8ECE
- MD5 SHA1 SHA512 SSDEEP TLSH
bundle/dumper/Plugins/Sources/PESpin_x64_v1.cpp
- SHA256 41b070c450777df3cdb6f1b00a71b707839ef5c5dc3042213cf3a9fa07750d58
- MD5 01d787ca10256a9deee088af5a21a627
- SHA1 9b1250b6fe03ada1126367d828afd75be85756ee
- SHA512 5c2fc9f27cf43c81b6ba82fb770189ad3eaf8fff48468117482fcd6a427414fa6e5fe7215950a7d9742e55efb7bbb9b9cbe6a466ce43cf84907a20735d748625
- SSDEEP 192:E7IqRkHICgj3VO41hOBRAupAdT7gWFUSuX+SNtPnHN+6Splhhch/:mRkoLjZXOBRAnQWFUSSdVt+djs
- TLSH T12852A89A7E0B3298DF03A0294170740A8C88F8E346E45B95F56DD357A3F50B78A77C9E
- MD5 SHA1 SHA512 SSDEEP TLSH
bundle/dumper/Plugins/Sources/scyllatoimprectree.rar
- SHA256 0dfd69edf658fc43d0792c4be29253ff45043fef1683ea9403c52db2d79229d0
- MD5 56bd11770317fd5e3578e6aa13fb7d4d
- SHA1 4206bbace2fdc959273cc67def218e3194549837
- SHA512 33c8f480be98580294cd82fb2ef9b1d099fd976b6660e5663840ee8903637d13f99d6859f519d3914498185cf5b8a941fa22cd24d0983f00422bb4e5f7045dcc
- SSDEEP 192:b72c3qscx9z7IphHIBfGc7wcozN5RY7Iph3xzNlAzcGcS7V+KGFh1P9JdOmlRBf:5qscx9Ip+BLwN/3pN9NlAzcbS7VvGH55
- TLSH T1C7229D7A8B0C715FADDB2A3105E5E09B51E295F2343936230DD7B29F0438AB786CE909
- MD5 SHA1 SHA512 SSDEEP TLSH
ScyllaToImprecTree.sln
- SHA256 7f0fd3895ed2a371583dd844f8b0c04e560b8370767da7d2cdd2e5c2b39ae025
- MD5 1c6527c8552001aeccbe59c648fc738b
- SHA1 b92ed86422256e10e6a8c12d8f5aa961303050b6
- SHA512 bb77e94bf13569259f1423abf770781aeb4249de7e0f6fb7ffbce0ba6896263a36dfe220fa1fe4f2c866a31d22713a3e3b3a7ffa8f370dcba4005dd473c8e59c
- TLSH T1481102FC312E3867258B027FA1C83C8B393F528143EE4978008351582B27B92829BA47
- MD5 SHA1 SHA512 TLSH
ScyllaToImprecTree/Form1.Designer.cs
- SHA256 2bc668bb07832ed3d6127662aa9afbb322616055dedeca17f60c590a1d323f01
- MD5 e1b90b61b3188f00141324cba0ff863d
- SHA1 667a11a27c72cc74ab51dc8051ab024bac4e4323
- SHA512 87dfd7f7fbd52f882d579cb3f4cf26251ca7b7e294cc3004a9425163d05cef56dd01421a8649c457cf7ec1324a4095695ddda894ce0cd2a8cd5dcc76b8c36770
- TLSH T199816AB8876F911C61E2604C8616D6C19E7D4232F1248D7FBECE4CF8D39A29D43782B6
- MD5 SHA1 SHA512 TLSH
ScyllaToImprecTree/Form1.cs
- SHA256 cfe74d42f8f5e1c089aa1f1fffb1dc6d89a60ace51afb7e0f32a6d61bc41875f
- MD5 7b15358b34496e1df146353b887265cb
- SHA1 23f9877e767fb9f1e5556d12effcfa79a5ed0d20
- SHA512 b54ad15e95e21fd51624686e797ce1a812aba9bdb2efeee78c73d7a818cc719d19b364da1115ce383c938bb6c735383c5290de6734d2cc71a6667240c96ca7a6
- TLSH T1B271FE57AB5D23EB4EC06118E99008FFAD7840B753214CF75CCE82ADB4A084E6F796B4
- MD5 SHA1 SHA512 TLSH
ScyllaToImprecTree/Form1.resx
- SHA256 4d3ee9059f5b98ab1806f6916ebea2a8c56023f8c63ddfd80b7378d27d1aa0f6
- MD5 96ba0a444d087ae06f32319ca4f0a3e4
- SHA1 e3e08973b3d47c1ad51ccb133315b6242e275f0f
- SHA512 571d4083c76428d8c3914b2bc1281cc79ed4603b5fe0e3e82ee58dad488fcfe7f797a45b0ea7f14841a2a100656f059c186b7338ce33beb910cdddbf9ee70cbb
- SSDEEP 96:ECf+lbD5X5LPXCazYV5Lv6K6uOidfaxwsxuUPFC3qxdRMvDbu8KsrbEKAy202lUt:Zf+tLPfYnLvFVOiFQaUD7Ut
- TLSH T172C11E45B2D1ED260E93483CD65139847BA8923F0234AC94B4DC961E5F92B85A7B33FA
- MD5 SHA1 SHA512 SSDEEP TLSH
ScyllaToImprecTree/Program.cs
- SHA256 623175cb703427705d16902a2776ff7329189254429fbe4dd543876dc0e7f95b
- MD5 71de3b37191c2ebe4b682611481fa608
- SHA1 fc2645d3d50431883cf7f1d44c2ff48bfd48774a
- SHA512 35c37753dc8be41f2285330e21efc45d5cf6160e329085d79e724f3ea9e44e04259788acd7e2a2e79fbc2d62990c7ea1e31b5fba7de16233478d2495b62f7ef0
- TLSH T14EE061B5796EE55CCED358B7081491CC137AB63C4E7938116C654DB4D825505437DC42
- MD5 SHA1 SHA512 TLSH
ScyllaToImprecTree/Properties/AssemblyInfo.cs
- SHA256 82c09666ec5c4727a0abb082c830f780a4aa3d8fde3a0c27035bd967184dc663
- MD5 445666959634ecf1b807951bd28d7d02
- SHA1 ebadc8953dbaaba20e638dd9f4b9ebdefce2ab11
- SHA512 4bdba68d988b4051c0fe048a2918d2ca6599bc3737c8aa83af20dd3623cf5e3636e5da812bfe3d71cdd763ba11fc37f2f6ed6c68151055b23a4e8638b4fa0787
- TLSH T1F231BB20A691F73D0F436313BEE7359E273EB36591D86415689DA893FA10BF402AC633
- MD5 SHA1 SHA512 TLSH
ScyllaToImprecTree/Properties/Resources.Designer.cs
- SHA256 81677e759573774859b115dc8ec383daa7242d73dd5dc4cd0f87bc57488b2eab
- MD5 4f086511f30b244cc110d4fa42cfb817
- SHA1 3276518e1f08cf1f92011448dc06fabb0c62c924
- SHA512 704e92b3038919ebdcf6148ec46d745ac0f7162dcbc1582d699b82aed875d3fa8f7f844c958e3f0393d494778446f0446e34d564b671d13a2737393b739039e7
- TLSH T1B45150F30FE9C5360815E59B4B01F851D7255223C22CE839F8AE42509FAE34143ED9BA
- MD5 SHA1 SHA512 TLSH
ScyllaToImprecTree/Properties/Resources.resx
- SHA256 4e124f5a7694ffe813c60601b1b73c53e47536b1f1c0e798d4d55bfc2ca3774f
- MD5 c07716633f086d91759ae32a18996a1a
- SHA1 bf3383c20acf6e64ce49f120938456161e5f6cb9
- SHA512 c6ad0ec603ff69d2d1b787db9426f29d44ea1ba45cf1d2b7ec41cc2bd6d5c93af8d2299139cc1c5d10d56718f36daa37d544f8d5411fad91a72efc2e70454cdf
- SSDEEP 96:ECf+lbD5X5LPXCazYV5Lv6K6uOidfaxwsxuUPFE3qxdRMvDTursrbLAy202W:Zf+tLPfYnLvFVOiFQaUR6
- TLSH T1E3B12045F2D5DD220AD3483CD64139847BA8923B4234AC94B4DC961E5F93F86A7B33FA
- MD5 SHA1 SHA512 SSDEEP TLSH
ScyllaToImprecTree/Properties/Settings.Designer.cs
- SHA256 4db74df4a4cd0060336a1131f5c6e3b7b2339252ff5d86e47971d8491d1ebac2
- MD5 ee8a2a6fbd867d98358ff4c9cb5058e2
- SHA1 4898f341791765f8721e740458391cc2cc445027
- SHA512 b630689f792d366d8a0d32c8389ed43c61210285d55c4179630d84a5077bb2a9c76d1627953a9cdf10ac20ccaebc1131cbb2d0a532af56071a1c34a33abd38d6
- TLSH T1B32104F13DA5DB3F0546E5EAD60AC1A3DB71422BC71DA835749C0001DF0564483FEBA9
- MD5 SHA1 SHA512 TLSH
ScyllaToImprecTree/Properties/Settings.settings
- SHA256 baba99193fc1787141063b135424b476ff4151beb833883fcb594631f17c0147
- MD5 29a2bb6bd6f85ff04804c473e895de92
- SHA1 48d8aedc9ac54affd627fd9737a0af3ba713f6e4
- SHA512 e2126226fde15a2cbf850824ae9bd2a04910aed905d3f6df366c629890f4ce07404c9fcf30bd41c61c73fb589ff254b8ab328bbddced7640e734098e542bdce2
- TLSH T148D0239BD488C406D6617D70F46CF13C4150677B047D927451F4784C150B1D313D35E6
- MD5 SHA1 SHA512 TLSH
ScyllaToImprecTree/ScyllaToImprecTree.csproj
- SHA256 f510b8a06444e6d2d546b451b168e94d813feee44df4aa2aedb7421b4b4563aa
- MD5 04be20e2aeed3c0af5f2527ae7c7e443
- SHA1 fd24e216fe421d9085285e02206c87bdc03f6f9b
- SHA512 d50b013d6881d4d614b10089bdbde077419cd2897d6979df8f85611e192e061ce0e1918b5edee33d52ccda074c7f8973a336593d20beb976542e7a08fd306c26
- TLSH T1B9712434D2FC5DFA53A02172C5A2BA020EA4B3E364744438FA8DD5844F92B881357B7F
- MD5 SHA1 SHA512 TLSH
ScyllaToImprecTree/app.config
- SHA256 775ccec32bf049770b51c867059f38f2cfae2598f3680af23fe2037159ad3763
- MD5 da329ec723a3192bf28aff2fe9f8313a
- SHA1 5935684ca167b23ce27fbba6983404a95b4f9cea
- SHA512 3b0c5f3a02b17b47d1ddfcec1a5ca7867a02ee6d3d40a3bfd08a9f4e26bc65b59f945b7b4c8ef6386d91ea1f389cf87916800d7264e71a05a28e67e2d1971091
- TLSH T149B092964628A82B2C120F53575406411FB902919168400CE0DF3F10160108E930A386
- MD5 SHA1 SHA512 TLSH
bundle/dumper/Scylla.ini
- SHA256 4649f8337526f31e9c21926ebb275aeaad1c9f67eeddc0a6717b59ffe5dce8ab
- MD5 47ea2a739c7d89a7eba559f54174cb82
- SHA1 c3b7df9ba5d224623259f995311655f3242014d4
- SHA512 0347cf272de0062902a498328bb8d3d66863c4c749b1f42d8e167fb043dcea5a3dc7b6a427cec402aa2c14ecca458fcc8620b4f708cce70c48f99167aceecfa3
- TLSH T120F0271D5787149FDA82CB4951A660AA08CAD00D3B4CF8ECE79246645FCC590B27EE5F
- MD5 SHA1 SHA512 TLSH
bundle/dumper/Scylla_Exports.txt
- SHA256 7ac8e423721bfde04bdf36143d310dd7b40ddfa956033e56add467e119912106
- MD5 ba69466e09279777e4e088b190addef8
- SHA1 2c15512eab040193937c15c5dfe6a61da94f7a89
- SHA512 03819e7c1e830d072072ebdafb5d558251dbaa4412e37b8d01ecdf93c2653a88d2975f790efb17857459e1e04934dd16723f7692833abae15cf6ff834e358dec
- SSDEEP 96:vUObi8Ad0jbRIQUObpM3GTkrCRxRuYjGuA+:vUObUQTUObW3GTau2WP
- TLSH T1CDC1D099CD4F5262AE47E2D96449208CCF87D90E33F443A478DF250267AF045A97DECE
- MD5 SHA1 SHA512 SSDEEP TLSH
bundle/dumper/Scylla_README.txt
- SHA256 21f64b482e3ae37ca9b2e9e8a87457e88c915af8b06b38b904dc48be49eeb660
- MD5 febd8aed73db0e22f5eab92fca743ee9
- SHA1 f81aa94a9ee6e2f33197cbd4846e7c61b54e41d9
- SHA512 6eac56a8ffe25205d37219fc495f868c26715407c80d4ab272f7b14fd17a7232b873e1aa393e227672b92bff48dd71257906efb8c9b87c487b48d86b144a8fed
- SSDEEP 96:GGFHjpL87X0dhyy4znevn8P+OS17tEVCRlWD/Fu3g:GeLSkhl2evnjt2CRQDmg
- TLSH T177B1875F9807F16409F34E495263657AFB6A0236B79280A430A5D27C7B086FDE61F27C
- MD5 SHA1 SHA512 SSDEEP TLSH
bundle/dumper/Scylla_x64.dll
- IMPHASH a4b192fb7f7c9235dafc61f7c2ce1c63
- SHA256 183671a094a184f3bb22b893cbce8a77f4bbc3932d96a1113b7d93755ecca360
- MD5 7bd1b05fcef651cb71a401fb5954943d
- SHA1 d2c8a60e9bd14d85459519ef20ce3487e6270d82
- SHA512 aed6c7dffbcabe6062cabffeb904d017e7a15b3ca900279a902c8f09c7a0ef7e98795aaa05b4e38f38c694f407470f65327380f736f096595382b19f5ae6eb62
- SSDEEP 6144:dKsoPHO7OtFAlEYKvkmiV76xyGl4ImDkwGem/qzD/13tTykCnoIVRUt0dMkcwLSb:U3RtF41wmDkjSzWhnAmMkcwLv
- TLSH T1AAB47C59B7F808A9E077A13CCAA3C642F3B274550770D7CF5664967A2F23BE05A39720
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
248888
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
FindResourceW
LoadResource
SetUnhandledExceptionFilter
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
SizeofResource
LeaveCriticalSection
lstrlenW
SetLastError
EnterCriticalSection
lstrcmpiW
DeleteCriticalSection
GetCurrentThreadId
GetVersion
WriteFile
SetFilePointer
SetEndOfFile
ReadFile
FindFirstFileW
FindClose
FindNextFileW
CopyFileW
ReadProcessMemory
GetFileSizeEx
VirtualProtectEx
WideCharToMultiByte
GetVersionExW
GetSystemInfo
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStartupInfoW
GetFileType
SetHandleCount
HeapReAlloc
GetLastError
GetStdHandle
HeapDestroy
HeapCreate
HeapSetInformation
GetStringTypeW
ExitProcess
HeapSize
Sleep
FlsAlloc
FlsFree
FlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
RtlPcToFileHeader
RtlUnwindEx
RtlLookupFunctionEntry
GetCommandLineA
FlsSetValue
DecodePointer
EncodePointer
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
GetProcessHeap
HeapAlloc
HeapFree
InterlockedPushEntrySList
lstrlenA
CreateFileW
MultiByteToWideChar
CreateFileMappingW
MapViewOfFile
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
WriteConsoleW
ResumeThread
WriteProcessMemory
CloseHandle
GetExitCodeThread
VirtualAllocEx
SetThreadPriority
LoadLibraryW
VirtualFreeEx
CreateRemoteThread
WaitForSingleObject
FreeLibrary
GlobalFree
RaiseException
FlushInstructionCache
GlobalUnlock
MulDiv
GlobalAlloc
GlobalLock
GetCurrentProcess
QueryDosDeviceW
GetPrivateProfileIntW
WritePrivateProfileStringW
GetModuleFileNameW
GetPrivateProfileStringW
GetModuleHandleA
LoadLibraryA
GetProcAddress
VirtualQueryEx
GetModuleHandleW
LCMapStringW
UnmapViewOfFile
user32
LoadIconW
DragDetect
IsDialogMessageW
GetMenu
IntersectRect
InflateRect
GetKeyState
EnableMenuItem
GetSysColor
GetActiveWindow
AdjustWindowRectEx
SetCapture
PostQuitMessage
ScreenToClient
LoadAcceleratorsW
AppendMenuW
DialogBoxParamW
ReleaseCapture
EnableWindow
GetMessagePos
DestroyAcceleratorTable
GetMessageW
TranslateAcceleratorW
GetWindowTextLengthW
SetDlgItemTextW
ReleaseDC
CharNextW
TranslateMessage
PeekMessageW
CreateDialogParamW
DispatchMessageW
UpdateWindow
LoadImageW
GetDC
GetDesktopWindow
DestroyIcon
SetFocus
ClientToScreen
CloseClipboard
MonitorFromPoint
TrackPopupMenu
GetSubMenu
IsClipboardFormatAvailable
MessageBeep
GetWindowLongPtrW
InvalidateRect
LoadMenuW
GetClipboardData
GetWindowTextW
EmptyClipboard
SetWindowLongW
RedrawWindow
ShowWindow
IsWindow
OpenClipboard
MessageBoxW
IsWindowVisible
SetWindowLongPtrW
SetClipboardData
DestroyMenu
GetDlgCtrlID
CallWindowProcW
DefWindowProcW
DestroyWindow
GetWindowRect
GetParent
GetClientRect
GetWindowLongW
MonitorFromWindow
GetDlgItem
EndDialog
SetWindowPos
CreateWindowExW
SendMessageW
MapWindowPoints
SetWindowTextW
GetMonitorInfoW
GetWindow
CreatePopupMenu
UnregisterClassA
gdi32
GetObjectW
DeleteObject
CreateFontIndirectW
GetDeviceCaps
GetClipBox
CreatePatternBrush
CreateRectRgn
CombineRgn
CreateRectRgnIndirect
SelectClipRgn
SelectObject
CreateBitmap
PatBlt
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
shell32
ShellExecuteW
ole32
CoInitialize
CoTaskMemRealloc
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
oleaut32
VarUI4FromStr
shlwapi
PathAppendW
PathRemoveFileSpecW
comctl32
ImageList_ReplaceIcon
ImageList_Create
InitCommonControlsEx
ImageList_Destroy
psapi
GetModuleFileNameExW
GetMappedFileNameW
EnumProcessModules
GetProcessImageFileNameW
imagehlp
CheckSumMappedFile
ScyllaDumpCurrentProcessA
ScyllaDumpCurrentProcessW
ScyllaDumpProcessA
ScyllaDumpProcessW
ScyllaIatFixAutoW
ScyllaIatSearch
ScyllaRebuildFileA
ScyllaRebuildFileW
ScyllaStartGui
ScyllaVersionInformationA
ScyllaVersionInformationDword
ScyllaVersionInformationW
Name
.text
Size
311KB
Virtual Size
311KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
96KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
39KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=25, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=259, id=1, productName=Unmarked objects,
count=63, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=145, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=35, id=175, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
bundle/dumper/Scylla_x64.exe
- IMPHASH bcac76bb6976db70842f08f6e2e54ce6
- SHA256 47889e39785f0f50d6254ac29eceb2e5b39667eb74986e01d80b3042679f35d2
- MD5 9e6ecb3625b7ca4ffb2167958d9cdf72
- SHA1 8d8b8ae5d66101fe8b95182708506d90ea6cf471
- SHA512 716d2f9c3beec854f0e9598cd030d4ee0bc611cf19ea479d7f2468ad85440a4213f28745c4cf37ae85dcd5566ca9f14b9208efe2d3465ab4fe3e8c38bc716a98
- SSDEEP 6144:ojm7X2kYngdKc2jfiF6G1Nmbe40jVEUFlTHYkifA2O9d/ffdcEZUd4rQk:vAHdCmbeNjDYkzfV/Y
- TLSH T151B47C56F7E808E9E077A138CAA3C742E7B274540B70D7CF5668967A2F236E05D39720
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
243940
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
LoadResource
SetUnhandledExceptionFilter
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
SizeofResource
LeaveCriticalSection
lstrlenW
SetLastError
EnterCriticalSection
lstrcmpiW
DeleteCriticalSection
GetCurrentThreadId
GetVersion
CreateFileW
SetFilePointer
SetEndOfFile
ReadFile
FindFirstFileW
FindClose
FindNextFileW
WriteFile
CopyFileW
ReadProcessMemory
GetFileSizeEx
VirtualProtectEx
WideCharToMultiByte
GetVersionExW
GetSystemInfo
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetFileType
SetHandleCount
HeapReAlloc
FindResourceW
GetStdHandle
HeapCreate
HeapSetInformation
GetStringTypeW
ExitProcess
HeapSize
Sleep
FlsAlloc
FlsFree
FlsSetValue
FlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
RtlPcToFileHeader
RtlUnwindEx
RtlLookupFunctionEntry
GetStartupInfoW
GetCommandLineW
DecodePointer
EncodePointer
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
GetProcessHeap
HeapAlloc
HeapFree
InterlockedPushEntrySList
GetLastError
lstrlenA
MultiByteToWideChar
CreateFileMappingW
MapViewOfFile
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
WriteConsoleW
ResumeThread
WriteProcessMemory
CloseHandle
GetExitCodeThread
VirtualAllocEx
SetThreadPriority
LoadLibraryW
VirtualFreeEx
CreateRemoteThread
WaitForSingleObject
FreeLibrary
GlobalFree
RaiseException
FlushInstructionCache
GlobalUnlock
MulDiv
GlobalAlloc
GlobalLock
GetCurrentProcess
QueryDosDeviceW
GetPrivateProfileIntW
WritePrivateProfileStringW
GetModuleFileNameW
GetPrivateProfileStringW
GetModuleHandleA
LoadLibraryA
GetProcAddress
VirtualQueryEx
GetModuleHandleW
LCMapStringW
UnmapViewOfFile
user32
LoadIconW
DragDetect
IntersectRect
IsDialogMessageW
GetMenu
AppendMenuW
InflateRect
GetKeyState
GetSysColor
GetActiveWindow
AdjustWindowRectEx
ReleaseCapture
SetCapture
PostQuitMessage
ScreenToClient
LoadAcceleratorsW
ReleaseDC
DialogBoxParamW
EnableWindow
GetMessagePos
DestroyAcceleratorTable
GetMessageW
CharNextW
TranslateAcceleratorW
GetWindowTextLengthW
SetDlgItemTextW
EnableMenuItem
TranslateMessage
PeekMessageW
CreateDialogParamW
DispatchMessageW
UpdateWindow
LoadImageW
GetDC
GetDesktopWindow
DestroyIcon
SetFocus
ClientToScreen
CloseClipboard
MonitorFromPoint
TrackPopupMenu
GetSubMenu
IsClipboardFormatAvailable
MessageBeep
GetWindowLongPtrW
InvalidateRect
LoadMenuW
GetClipboardData
GetWindowTextW
EmptyClipboard
SetWindowLongW
RedrawWindow
ShowWindow
IsWindow
OpenClipboard
MessageBoxW
IsWindowVisible
SetWindowLongPtrW
SetClipboardData
DestroyMenu
GetDlgCtrlID
CallWindowProcW
DefWindowProcW
DestroyWindow
GetWindowRect
GetParent
GetClientRect
GetWindowLongW
MonitorFromWindow
GetDlgItem
EndDialog
SetWindowPos
CreateWindowExW
SendMessageW
MapWindowPoints
SetWindowTextW
GetMonitorInfoW
GetWindow
CreatePopupMenu
UnregisterClassA
gdi32
GetObjectW
DeleteObject
CreateFontIndirectW
GetDeviceCaps
GetClipBox
CreatePatternBrush
CreateRectRgn
CombineRgn
CreateRectRgnIndirect
SelectClipRgn
SelectObject
PatBlt
CreateBitmap
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
shell32
ShellExecuteW
ole32
CoTaskMemFree
CoTaskMemRealloc
CoUninitialize
CoCreateInstance
CoInitialize
CoTaskMemAlloc
oleaut32
VarUI4FromStr
shlwapi
PathAppendW
PathRemoveFileSpecW
comctl32
ImageList_ReplaceIcon
ImageList_Create
InitCommonControlsEx
ImageList_Destroy
psapi
GetModuleFileNameExW
GetMappedFileNameW
EnumProcessModules
GetProcessImageFileNameW
imagehlp
CheckSumMappedFile
Name
.text
Size
306KB
Virtual Size
305KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
94KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
39KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=25, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=255, id=1, productName=Unmarked objects,
count=63, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=145, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=32, id=175, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
bundle/dumper/Scylla_x64.lib
- SHA256 a0728f67a48dc06083b942a6718d95c1fad0082cb551360be8d31041712108f6
- MD5 10ebf4b3e029c5e0d323e948791c2178
- SHA1 f5bf5249509cd8770521672bdf761a85f3bfc421
- SHA512 aa226cf55787f66da42b780bad40144fe1f67ac0265c95011e1e92690628e13cc24759ff56420494165f694595e6dcd78e5d85e888f7c0522e25069c5859ed16
- SSDEEP 96:v++jExEbjE8dExAKKK61KRR4KzSntgLmiqE9z684lqyqy:2+j0M1d0dSow
- TLSH T1CBB187700CCE7846FE94B53A80E5595E7A7D67152342167E32FF882897DDB0DB22F801
- MD5 SHA1 SHA512 SSDEEP TLSH
bundle/dumper/Scylla_x64.map
- SHA256 bfb0b0580be48152a6038b4aad41b45fe8cc444d6460f94dacace3c27a17ffd9
- MD5 a3d0d4035787767bdbe84df1f35ba064
- SHA1 50f8441d065593c029def3dfdb929a70d539885d
- SHA512 6500ab4b527b6e5ccbdfb32347dcc627a3a05bbd74c11cbcb2fd43994bcf78769e6e13fa644bf44e7ecc9119d1da95eae4edf6ebcb257f0cb6f67dd5e05e6d51
- SSDEEP 6144:XhOTr02Cv2mfbjNuHOdCqBa04PVtCo02uDf5:XhOTr02kfbjcjnCo0Vf5
- TLSH T19194DD7031CDD5C2E177AB05BB50BE25E04CF583D2D265D732BEA3B2A7D124AA58B207
- MD5 SHA1 SHA512 SSDEEP TLSH
bundle/dumper/Scylla_x86.dll
- IMPHASH e6bc99b225199cc89f30d44d09453207
- SHA256 e21db48a70ed20fab35139e7919d9c1833d0728c33ec9d95802daf1571fcd12e
- MD5 738b9e4e29c12a8cc9c43e477c8940e4
- SHA1 fdfac85735242f90f5ebb0b5c4ae77d45499e916
- SHA512 b00456e830d4e18f3052b78bda7826f62cc231c34fb09e6490475d2720ec82d90d43641f0740ad87d4d26929bc8ec3b08748da8433c19aa1ed16bf5cc403604f
- SSDEEP 12288:dAgJHfZPW2qmAvztIAZDdpm2x/12lwjAHMB4F:dsztIAS2SlwjAHMB4
- TLSH T149A49D31B681C077E4EB013099BEDBBA657DB661172982C7F38809AF5E642D12F3474B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
241273
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
FindResourceW
LoadResource
SetUnhandledExceptionFilter
LoadLibraryExW
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
SizeofResource
LeaveCriticalSection
lstrlenW
SetLastError
EnterCriticalSection
lstrcmpiW
DeleteCriticalSection
GetCurrentThreadId
GetVersion
WriteFile
SetFilePointer
SetEndOfFile
ReadFile
FindFirstFileW
GetFileAttributesW
FindClose
FindNextFileW
CopyFileW
ReadProcessMemory
GetFileSizeEx
VirtualProtectEx
WideCharToMultiByte
GetVersionExW
GetSystemInfo
GetConsoleCP
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentProcess
QueryPerformanceCounter
GetEnvironmentStringsW
FreeLibrary
GetEnvironmentStrings
GetLastError
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringW
GetModuleFileNameA
GetStdHandle
HeapReAlloc
HeapDestroy
HeapCreate
ExitProcess
HeapSize
Sleep
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RtlUnwind
GetCommandLineA
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
SetStdHandle
FlushFileBuffers
CreateFileA
GlobalFree
RaiseException
GetConsoleMode
FlushInstructionCache
GlobalUnlock
MulDiv
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
QueryDosDeviceW
GetPrivateProfileIntW
WritePrivateProfileStringW
GetModuleFileNameW
GetPrivateProfileStringW
GetModuleHandleA
lstrlenA
CreateFileW
MultiByteToWideChar
CreateFileMappingW
MapViewOfFile
ResumeThread
WriteProcessMemory
CloseHandle
GetExitCodeThread
VirtualAllocEx
SetThreadPriority
LoadLibraryW
VirtualFreeEx
CreateRemoteThread
FreeEnvironmentStringsA
WaitForSingleObject
GlobalAlloc
FreeEnvironmentStringsW
GlobalLock
LoadLibraryA
GetProcAddress
VirtualQueryEx
GetModuleHandleW
GetTickCount
UnmapViewOfFile
user32
InflateRect
LoadAcceleratorsW
DialogBoxParamW
PostQuitMessage
GetKeyState
SetCapture
IsDialogMessageW
GetMenu
LoadIconW
DragDetect
IntersectRect
ReleaseDC
EnableMenuItem
ScreenToClient
TranslateAcceleratorW
GetWindowTextLengthW
SetDlgItemTextW
GetSysColor
CreatePopupMenu
GetActiveWindow
AdjustWindowRectEx
ReleaseCapture
EnableWindow
GetMessagePos
DestroyAcceleratorTable
GetMessageW
CharNextW
TranslateMessage
PeekMessageW
CreateDialogParamW
DispatchMessageW
UpdateWindow
LoadImageW
GetDC
GetDesktopWindow
DestroyIcon
SetFocus
ClientToScreen
CloseClipboard
MonitorFromPoint
TrackPopupMenu
GetSubMenu
IsClipboardFormatAvailable
MessageBeep
InvalidateRect
LoadMenuW
GetClipboardData
GetWindowTextW
EmptyClipboard
SetWindowLongW
RedrawWindow
ShowWindow
IsWindow
OpenClipboard
MessageBoxW
IsWindowVisible
SetClipboardData
DestroyMenu
GetDlgCtrlID
CallWindowProcW
DefWindowProcW
DestroyWindow
GetWindowRect
GetParent
GetClientRect
GetWindowLongW
MonitorFromWindow
GetDlgItem
EndDialog
SetWindowPos
CreateWindowExW
SendMessageW
MapWindowPoints
SetWindowTextW
GetMonitorInfoW
GetWindow
AppendMenuW
UnregisterClassA
gdi32
CreateBitmap
SelectObject
SelectClipRgn
CreateRectRgnIndirect
CombineRgn
CreateRectRgn
CreatePatternBrush
GetClipBox
GetDeviceCaps
CreateFontIndirectW
DeleteObject
GetObjectW
PatBlt
comdlg32
GetOpenFileNameW
GetSaveFileNameW
advapi32
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegCloseKey
RegSetValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
shell32
ShellExecuteW
ole32
CoInitialize
CoTaskMemRealloc
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
oleaut32
VarUI4FromStr
shlwapi
PathRemoveFileSpecW
PathAppendW
comctl32
InitCommonControlsEx
ImageList_Destroy
ImageList_ReplaceIcon
ImageList_Create
psapi
GetModuleFileNameExW
GetMappedFileNameW
EnumProcessModules
GetProcessImageFileNameW
imagehlp
CheckSumMappedFile
ScyllaDumpCurrentProcessA
ScyllaDumpCurrentProcessW
ScyllaDumpProcessA
ScyllaDumpProcessW
ScyllaIatFixAutoW
ScyllaIatSearch
ScyllaRebuildFileA
ScyllaRebuildFileW
ScyllaStartGui
ScyllaVersionInformationA
ScyllaVersionInformationDword
ScyllaVersionInformationW
Name
.text
Size
305KB
Virtual Size
304KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
36KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=149, productName=VS2008 build 21022, version=21022,
count=152, id=131, productName=VS2008 build 21022, version=21022,
count=64, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=25, id=123, productName=VS2005 build 50727, version=50727,
count=266, id=1, productName=Unmarked objects,
count=4, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=35, id=138, version=21022,
count=1, id=146, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
bundle/dumper/Scylla_x86.exe
- IMPHASH 13f803d90a1a8166ecfc4197841a663f
- SHA256 4b49b0827f447d8d272c4f118c7c0afd2c786c12751e8e6e32e8477586afcc75
- MD5 3cf24b68ce13aac31a2808bab6a805ea
- SHA1 0bd75d62fb43cb5e3039fb5ae4c4e09a6841372c
- SHA512 85f169eefbc340dbe6b3b949c4ecde7df6db1cd408f546723901f2a4b6144da83c5b23e3c5eee63157ada09538f0b7520ca42cb5a41fecbb4147dcf5c20077df
- SSDEEP 12288:g0QsSmAKgxCk5IPYOVhJUInmB0kwKyI6t2CtOjpcoPa:g0CyjJUIw0kwK5hjpco
- TLSH T103A48D31B791C032E1E312708DBEDB79A57EB2611B2685C773C40EAE5EA42E16E35347
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
238004
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LoadResource
SetUnhandledExceptionFilter
LoadLibraryExW
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
SizeofResource
LeaveCriticalSection
lstrlenW
SetLastError
EnterCriticalSection
lstrcmpiW
DeleteCriticalSection
GetCurrentThreadId
GetVersion
CreateFileW
SetFilePointer
SetEndOfFile
ReadFile
FindFirstFileW
GetFileAttributesW
FindClose
FindNextFileW
WriteFile
CopyFileW
ReadProcessMemory
GetFileSizeEx
VirtualProtectEx
WideCharToMultiByte
GetVersionExW
GetSystemInfo
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringA
GetCurrentProcess
GetCurrentProcessId
GetTickCount
FreeLibrary
GetCommandLineW
GetEnvironmentStringsW
FindResourceW
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringW
GetModuleFileNameA
GetStdHandle
HeapReAlloc
HeapCreate
ExitProcess
HeapSize
Sleep
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RtlUnwind
GetStartupInfoW
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
FlushFileBuffers
CreateFileA
GlobalFree
RaiseException
FlushInstructionCache
SetStdHandle
GlobalUnlock
MulDiv
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
QueryDosDeviceW
GetPrivateProfileIntW
WritePrivateProfileStringW
GetModuleFileNameW
GetPrivateProfileStringW
GetModuleHandleA
LoadLibraryA
GetLastError
lstrlenA
MultiByteToWideChar
CreateFileMappingW
MapViewOfFile
ResumeThread
WriteProcessMemory
CloseHandle
GetExitCodeThread
VirtualAllocEx
SetThreadPriority
LoadLibraryW
VirtualFreeEx
CreateRemoteThread
FreeEnvironmentStringsW
WaitForSingleObject
GlobalAlloc
QueryPerformanceCounter
GlobalLock
GetProcAddress
VirtualQueryEx
GetModuleHandleW
GetSystemTimeAsFileTime
UnmapViewOfFile
user32
GetMenu
IsDialogMessageW
LoadIconW
InflateRect
SetCapture
PostQuitMessage
LoadAcceleratorsW
DialogBoxParamW
GetKeyState
DragDetect
IntersectRect
ReleaseDC
EnableMenuItem
GetSysColor
ScreenToClient
TranslateAcceleratorW
GetWindowTextLengthW
SetDlgItemTextW
CreatePopupMenu
GetActiveWindow
AdjustWindowRectEx
ReleaseCapture
EnableWindow
GetMessagePos
DestroyAcceleratorTable
GetMessageW
CharNextW
TranslateMessage
PeekMessageW
CreateDialogParamW
DispatchMessageW
UpdateWindow
LoadImageW
GetDC
GetDesktopWindow
DestroyIcon
SetFocus
ClientToScreen
CloseClipboard
MonitorFromPoint
TrackPopupMenu
GetSubMenu
IsClipboardFormatAvailable
MessageBeep
InvalidateRect
LoadMenuW
GetClipboardData
GetWindowTextW
EmptyClipboard
SetWindowLongW
RedrawWindow
ShowWindow
IsWindow
OpenClipboard
MessageBoxW
IsWindowVisible
SetClipboardData
DestroyMenu
GetDlgCtrlID
CallWindowProcW
DefWindowProcW
DestroyWindow
GetWindowRect
GetParent
GetClientRect
GetWindowLongW
MonitorFromWindow
GetDlgItem
EndDialog
SetWindowPos
CreateWindowExW
SendMessageW
MapWindowPoints
SetWindowTextW
GetMonitorInfoW
GetWindow
AppendMenuW
UnregisterClassA
gdi32
CreateBitmap
SelectObject
SelectClipRgn
CreateRectRgnIndirect
CombineRgn
CreateRectRgn
CreatePatternBrush
GetClipBox
GetDeviceCaps
CreateFontIndirectW
DeleteObject
GetObjectW
PatBlt
comdlg32
GetOpenFileNameW
GetSaveFileNameW
advapi32
RegOpenKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegDeleteValueW
shell32
ShellExecuteW
ole32
CoTaskMemFree
CoTaskMemRealloc
CoUninitialize
CoCreateInstance
CoInitialize
CoTaskMemAlloc
oleaut32
VarUI4FromStr
shlwapi
PathRemoveFileSpecW
PathAppendW
comctl32
InitCommonControlsEx
ImageList_Destroy
ImageList_ReplaceIcon
ImageList_Create
psapi
GetModuleFileNameExW
GetMappedFileNameW
EnumProcessModules
GetProcessImageFileNameW
imagehlp
CheckSumMappedFile
Name
.text
Size
301KB
Virtual Size
300KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
36KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=149, productName=VS2008 build 21022, version=21022,
count=153, id=131, productName=VS2008 build 21022, version=21022,
count=64, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=25, id=123, productName=VS2005 build 50727, version=50727,
count=262, id=1, productName=Unmarked objects,
count=4, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=32, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
bundle/dumper/Scylla_x86.lib
- SHA256 4df0c9033a9a0d25419b386d9780229d1792fc94edb8043b09520a18ffc59f29
- MD5 289c9030b118c038ae69b252965fc262
- SHA1 63785ea020c63709617bde50d7ece272ef795ff3
- SHA512 f561997cf16e25cb72bf5c1f48e599919e8ca7e02ffdd09c8a0d7e7fc0e5e1d99e5d80a17721212cf866928b8781c92c1502d8ff1370c4e3af8bf346139891ec
- SSDEEP 96:7pim0nBMEeEGAPzbHEDOPhrEeTpK5oKHKsH3EAYGF8:Nim0nBM9WzbHYUhr90H3J4
- TLSH T1E1B1577968EF7803FD55723A12F9489E36697B017341576B32EF48288FDDA2C792B500
- MD5 SHA1 SHA512 SSDEEP TLSH
bundle/dumper/Scylla_x86.map
- SHA256 00fd71f1a7f4ccc0045d596507d784596f30d5e7288dbb23b79cb6fabad76c8c
- MD5 f9c57ff2a15a314d31c4f2c6f63d2012
- SHA1 fc1df80675537d92b2a7dedb8c3a15f0c8118899
- SHA512 861c1005fe5662e2903916999f42625be210e999c25e9c370ba8a7b2cd93aa026791b1b39e6ab9c2e33b241d02b4cf1966b12875986d80fe631f282ba10bb137
- SSDEEP 3072:nUROsgQtU8dZ1u03FrJg9NExICSLTj+1kbijpjKLKE5:nUROsgQtU8dZ1uES9N5O1kbijpjKLKS
- TLSH T10DA45330318DD5C3916A6B04FF51EF25A55CF503D3A2B59731EEE3925BC228AA9C720B
- MD5 SHA1 SHA512 SSDEEP TLSH
bundle/eon.exe
- IMPHASH bfb4cbf9ff9b751543bb1eefe500d548
- SHA256 5732c8c276a56e3be14681104c173da854bcdf75affcc6ef5b50e5127e07e35c
- MD5 1261b4f0888e4128f2b3bfebca4c5baa
- SHA1 a259ae1fd90717599bd73d7807c355722a0211d6
- SHA512 9808051c4471c53b56b0c1fe7467e62bb80791d7be204294c3ab2bed5b93eda899e8d497bb0c3a99d6e66e1dd3a628235d1f7994ebe353f75b7a8503171687d2
- SSDEEP 393216:MYw7K3TDkGYrJtX6816vGwgLdYRAzFFAmmTFpAgeNcXRXS:MYKK3HkGkqESGzRYMYmmTFKkFS
- TLSH T1BC3712D5A8C446ECC792C635D28A16FEE2C5749A0FBA542F7FCA18023271C41D9E7E39
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
17598481
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d3d11
D3D11CreateDeviceAndSwapChain
advapi32
RegOpenKeyExW
ntdll
NtLoadDriver
d3dcompiler_47
D3DCompile
urlmon
URLDownloadToFileA
kernel32
GetModuleHandleW
user32
DispatchMessageW
shell32
ShellExecuteW
imm32
ImmReleaseContext
dwmapi
DwmExtendFrameIntoClientArea
msvcp140
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
xinput1_4
ord2
shlwapi
PathFindFileNameW
psapi
GetModuleInformation
userenv
UnloadUserProfile
bcrypt
BCryptGenRandom
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strchr
api-ms-win-crt-stdio-l1-1-0
fflush
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-convert-l1-1-0
wcstombs
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-math-l1-1-0
atan2f
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-locale-l1-1-0
localeconv
ws2_32
getpeername
crypt32
CertGetCertificateChain
Name
.text
Size
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
425KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
."D{
Size
Virtual Size
14.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.}RT
Size
1024B
Virtual Size
560B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.+j~
Size
23.0MB
Virtual Size
23.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ