NightCoop-0.1.2-beta-2.5.zip
- SHA256 5418bc90a68c650344126a9532bec933d18c3e70cb9a97c515bb8695533c1621
Static task
static1
1 signatures
General
- Target NightCoop-0.1.2-beta-2.5.zip
- Size 8.5MB
- Sample261027-t1tw6avyaz
- SHA256 5418bc90a68c650344126a9532bec933d18c3e70cb9a97c515bb8695533c1621
- MD5 88ba6f9576a4d3a1d98aca32a3fae2bf
- SHA1 8ef9ee6dd719987b247aa7ae07f3df668f2fd9c9
- SHA512 39454a36f647d6da78fa18c19240a007e565702517c9e64585b67429cc6c517de310a987778568f67708506551a72fe78268a16aef992380d4f9eca9616d5080
- SSDEEP 196608:EkU370SKr5hiLIfBSQTG5pT1eBAlovuoNa5bHX5y5+Ke6A7yOE3j8gd7w:xE7Uthc+BS4GOAloC3u2iOy8gd7w
- TLSH T1D99633E88ADE8B62C26A51FB6F03F2128ECF2B716E54B4B545E28415C4F88F55D7F081
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/bin/x64/winmm.dll unpack001/red4ext/RED4ext.dll unpack001/red4ext/plugins/NightCoop/NightCoop.dll
File Explorer
-
NightCoop-0.1.2-beta-2.5.zip.zip 8.5MB
-
bin/x64/winmm.dll.dll 208KB
-
red4ext/LICENSE.txt1KB
-
red4ext/RED4ext.dll.dll 1.2MB
-
red4ext/THIRD_PARTY_LICENSES.txt9KB
-
red4ext/plugins/NightCoop/NightCoop.dll.dll 18.1MB
bin/x64/winmm.dll
- IMPHASH ffe2d67532af2095e39019902ed94f17
- SHA256 c78308921e6697473b6407bf2a4ba1ac4c157b247031fbcdd91af5063a52af7d
- MD5 c7cab6a266cd7a824da90a9fc09f227e
- SHA1 45d2663dd7c0f97838e690f5d542d794c17bad6a
- SHA512 1d22c570ee95317008fc8336bdceb4745ea419f4071c8fbb11d9e2ca79598b22f787c88f3be1b089b40936565336d047c026e6f1e9d23599eaa81aad8ff859ea
- SSDEEP 6144:tQpYCPpOxpWi9r02HbD1zGLFMnBCO/vcBNW:m98pwIKMnBj
- TLSH T165248F65B19840A8D77BC0FD8943D902FAB2745583A09AC733609EE51F53FEAB7BD600
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
152720
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\RED4ext\RED4ext\build\bin\winmm.pdb
kernel32
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
WideCharToMultiByte
DebugBreak
IsDebuggerPresent
DisableThreadLibraryCalls
LoadLibraryW
K32GetModuleFileNameExW
GetModuleFileNameW
LocalFree
GetLocaleInfoEx
FindClose
FindFirstFileW
InitializeSListHead
GetSystemTimeAsFileTime
GetFileAttributesExW
CreateFile2
AreFileApisANSI
FormatMessageA
GetFileInformationByHandleEx
MultiByteToWideChar
QueryPerformanceCounter
user32
MessageBoxW
MessageBoxA
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
msvcp140
?id@?$numpunct@D@std@@2V0locale@2@A
?_Xbad_alloc@std@@YAXXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Id_cnt@id@locale@std@@0HA
?id@?$numpunct@_W@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
_Mbrtowc
??0_Lockit@std@@QEAA@H@Z
??1facet@locale@std@@MEAA@XZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
memcmp
memset
__std_terminate
__std_exception_copy
__std_exception_destroy
__C_specific_handler
memmove
_CxxThrowException
_purecall
__std_type_info_destroy_list
api-ms-win-crt-heap-l1-1-0
calloc
free
_callnewh
malloc
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_initialize_onexit_table
_register_onexit_function
_initterm
_execute_onexit_table
_crt_atexit
_cexit
_configure_narrow_argv
_invalid_parameter_noinfo
_errno
abort
_initterm_e
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
api-ms-win-crt-math-l1-1-0
_dsign
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
strlen
wcslen
CloseDriver
DefDriverProc
DriverCallback
DrvGetModuleHandle
GetDriverModuleHandle
OpenDriver
PlaySound
PlaySoundA
PlaySoundStub
PlaySoundW
SendDriverMessage
WOWAppExit
auxGetDevCapsA
auxGetDevCapsW
auxGetNumDevs
auxGetVolume
auxOutMessage
auxSetVolume
joyConfigChanged
joyGetDevCapsA
joyGetDevCapsW
joyGetNumDevs
joyGetPos
joyGetPosEx
joyGetThreshold
joyReleaseCapture
joySetCapture
joySetThreshold
mciDriverNotify
mciDriverYield
mciExecute
mciFreeCommandResource
mciGetCreatorTask
mciGetDeviceIDA
mciGetDeviceIDFromElementIDA
mciGetDeviceIDFromElementIDW
mciGetDeviceIDW
mciGetDriverData
mciGetErrorStringA
mciGetErrorStringW
mciGetYieldProc
mciLoadCommandResource
mciSendCommandA
mciSendCommandW
mciSendStringA
mciSendStringW
mciSetDriverData
mciSetYieldProc
midiConnect
midiDisconnect
midiInAddBuffer
midiInClose
midiInGetDevCapsA
midiInGetDevCapsW
midiInGetErrorTextA
midiInGetErrorTextW
midiInGetID
midiInGetNumDevs
midiInMessage
midiInOpen
midiInPrepareHeader
midiInReset
midiInStart
midiInStop
midiInUnprepareHeader
midiOutCacheDrumPatches
midiOutCachePatches
midiOutClose
midiOutGetDevCapsA
midiOutGetDevCapsW
midiOutGetErrorTextA
midiOutGetErrorTextW
midiOutGetID
midiOutGetNumDevs
midiOutGetVolume
midiOutLongMsg
midiOutMessage
midiOutOpen
midiOutPrepareHeader
midiOutReset
midiOutSetVolume
midiOutShortMsg
midiOutUnprepareHeader
midiStreamClose
midiStreamOpen
midiStreamOut
midiStreamPause
midiStreamPosition
midiStreamProperty
midiStreamRestart
midiStreamStop
mixerClose
mixerGetControlDetailsA
mixerGetControlDetailsW
mixerGetDevCapsA
mixerGetDevCapsW
mixerGetID
mixerGetLineControlsA
mixerGetLineControlsW
mixerGetLineInfoA
mixerGetLineInfoW
mixerGetNumDevs
mixerMessage
mixerOpen
mixerSetControlDetails
mmDrvInstall
mmGetCurrentTask
mmTaskBlock
mmTaskCreate
mmTaskSignal
mmTaskYield
mmioAdvance
mmioAscend
mmioClose
mmioCreateChunk
mmioDescend
mmioFlush
mmioGetInfo
mmioInstallIOProcA
mmioInstallIOProcW
mmioOpenA
mmioOpenW
mmioRead
mmioRenameA
mmioRenameW
mmioSeek
mmioSendMessage
mmioSetBuffer
mmioSetInfo
mmioStringToFOURCCA
mmioStringToFOURCCW
mmioWrite
mmsystemGetVersion
sndPlaySoundA
sndPlaySoundW
timeBeginPeriod
timeEndPeriod
timeGetDevCaps
timeGetSystemTime
timeGetTime
timeKillEvent
timeSetEvent
waveInAddBuffer
waveInClose
waveInGetDevCapsA
waveInGetDevCapsW
waveInGetErrorTextA
waveInGetErrorTextW
waveInGetID
waveInGetNumDevs
waveInGetPosition
waveInMessage
waveInOpen
waveInPrepareHeader
waveInReset
waveInStart
waveInStop
waveInUnprepareHeader
waveOutBreakLoop
waveOutClose
waveOutGetDevCapsA
waveOutGetDevCapsW
waveOutGetErrorTextA
waveOutGetErrorTextW
waveOutGetID
waveOutGetNumDevs
waveOutGetPitch
waveOutGetPlaybackRate
waveOutGetPosition
waveOutGetVolume
waveOutMessage
waveOutOpen
waveOutPause
waveOutPrepareHeader
waveOutReset
waveOutRestart
waveOutSetPitch
waveOutSetPlaybackRate
waveOutSetVolume
waveOutUnprepareHeader
waveOutWrite
Name
.text
Size
150KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
300B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35721,
count=8, id=260, version=35721,
count=22, id=261, version=35721,
count=6, id=257, version=35721,
count=1, id=262, version=33145,
count=9, id=257, version=33145,
count=150, id=1, productName=Unmarked objects,
count=5, id=265, version=36260,
count=1, id=256, version=36260,
count=1, id=255, version=36260,
count=1, id=151,
count=1, id=258, version=36260,
red4ext/LICENSE.txt
- SHA256 a0b08b28ae3931a5a41a1788aac6c7a391513bfc3599272021ea5b2c1af2f6f6
- MD5 61ce38ba9eaf014edb0991e771218604
- SHA1 094bceedd26d2e7997559963b149be4e09e5d455
- SHA512 1c423a3771d1749cbf764cab384d6558e46f277c1032763b38375aaadeed6df7adeb6156a1a6f11bbeffedec3166ff05ccacae276f0b39bb1fe68d3ee7ffc2ee
- TLSH T15311E92F73960373189217A105B8ECC5F22BB14A7FAF2680346DF2051326058CAFFC64
- MD5 SHA1 SHA512 TLSH
red4ext/RED4ext.dll
- IMPHASH 892e715f76fdeb3ffc2006c1db42a722
- SHA256 58ddfe43766aa91249d11671b55a8323d5ec017f816d847affe4b6201dcd0709
- MD5 c95bd724eb3f32e7b69a8cf04b5a42c3
- SHA1 0dfd81ced968f12211d76ed9e83c95f0b95599f6
- SHA512 0d68304c3f82795f8fd189fff69ee83561fb8d88f594c8454d6215ae391b50af014f35dee23026ba18001cc307c714cb85ec9f4ebfac6aa2252bfc24f387b8dc
- SSDEEP 24576:0UKLhbdXZRPqeaNRUYRxIdbk/K76qPETevOCZq7nnb:0tdbdJBaNRUQxIFuK76qMTevOCZq7
- TLSH T161457D6571E941ACC0BBC0B9DB574A03EB727C090334EAEB16D0AA652F77AE0577E701
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
887792
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\RED4ext\RED4ext\build\bin\RED4ext.pdb
ntdll
NtQueryInformationThread
NtGetNextThread
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
kernel32
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetLocaleInfoEx
FormatMessageA
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
WideCharToMultiByte
DebugBreak
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
HeapLock
HeapUnlock
GetThreadId
AllocConsole
SetConsoleTitleW
GetConsoleWindow
FreeConsole
LoadLibraryW
K32GetModuleFileNameExW
GetModuleFileNameW
DisableThreadLibraryCalls
VirtualProtect
FreeLibrary
GetModuleHandleA
LoadLibraryExW
MultiByteToWideChar
LocalFree
VirtualFree
VirtualAlloc
SuspendThread
ResumeThread
GetCurrentThread
GetThreadContext
FlushInstructionCache
SetThreadContext
VirtualQuery
WriteConsoleW
Sleep
GetStdHandle
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
WriteFile
GetConsoleMode
GetSystemTimeAsFileTime
GetFileInformationByHandleEx
QueryPerformanceCounter
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
SetFileInformationByHandle
CreateFile2
AreFileApisANSI
InitializeSListHead
user32
MessageBoxW
DeleteMenu
GetSystemMenu
msvcp140
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Incref@facet@locale@std@@UEAAXXZ
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Id_cnt@id@locale@std@@0HA
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?good@ios_base@std@@QEBA_NXZ
?uncaught_exceptions@std@@YAHXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
_Mbrtowc
_Thrd_yield
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?exceptions@ios_base@std@@QEAAXH@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?fail@ios_base@std@@QEBA_NXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
?classic@locale@std@@SAAEBV12@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
_Mtx_unlock
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_lock
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
_Xtime_get_ticks
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?id@?$numpunct@D@std@@2V0locale@2@A
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?widen@?$ctype@_W@std@@QEBA_WD@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
_Cnd_signal
_Thrd_join
_Thrd_id
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?id@?$numpunct@_W@std@@2V0locale@2@A
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_type_info_destroy_list
__current_exception_context
__current_exception
memset
memmove
memcpy
memcmp
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__std_terminate
_purecall
strstr
__C_specific_handler
api-ms-win-crt-heap-l1-1-0
free
malloc
calloc
_callnewh
api-ms-win-crt-runtime-l1-1-0
_initterm_e
terminate
abort
_errno
_invalid_parameter_noinfo
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
api-ms-win-crt-stdio-l1-1-0
_fwrite_nolock
__stdio_common_vswprintf
fread
__stdio_common_vsprintf
_filelengthi64
_wfsopen
_fileno
__stdio_common_vsnwprintf_s
rewind
fputwc
ungetwc
fgetwc
__stdio_common_vsnprintf_s
freopen_s
_ftelli64
_fseeki64
fopen
__stdio_common_vsscanf
fgetc
ungetc
fgetpos
fsetpos
setvbuf
fputc
fwrite
_get_stream_buffer_pointers
__acrt_iob_func
fflush
__stdio_common_vfprintf
fclose
api-ms-win-crt-string-l1-1-0
isdigit
isupper
islower
towlower
isgraph
wcslen
strlen
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
_dsign
ceilf
copysign
_dclass
api-ms-win-crt-filesystem-l1-1-0
_wremove
_wstat64i32
_wmkdir
_lock_file
_wrename
_unlock_file
api-ms-win-crt-time-l1-1-0
strftime
_mkgmtime64
_mktime64
_localtime64_s
_gmtime64_s
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
RED4ext_ResolveAddress
Name
.text
Size
924KB
Virtual Size
923KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
223KB
Virtual Size
223KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
17KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35721,
count=8, id=260, version=35721,
count=32, id=261, version=35721,
count=6, id=257, version=35721,
count=9, id=257, version=33145,
count=388, id=1, productName=Unmarked objects,
count=62, id=265, version=36260,
count=1, id=256, version=36260,
count=1, id=255, version=36260,
count=1, id=151,
count=1, id=258, version=36260,
red4ext/THIRD_PARTY_LICENSES.txt
- SHA256 b49e3d32f961c21e0b15f4c9b11da9455d7c9905a457b1dfa88504f6592220ff
- MD5 aad63133ad20aac9d95d89082fa76873
- SHA1 9c04bdc8b7fdb02f4942869b9b0fb1540e192ecc
- SHA512 122649130a2449138fb053bc45b8746fbc7a9697578002b86f9f12ef158180c590c300ffd1901a7628cc89d02a1e570d537ba5e7e7758f3a3a79264e546c95ae
- SSDEEP 192:hRrcQHFd+8YXu3I35gHrQHhoQHdBk9wHFwrT3QHF7QHFWBraQHF8:z4YY8WAC5gLyoUBo4wX3Y7YWBuY8
- TLSH T1C322C82F725543A3189217A16569ECC5F22FB14E7E6F2A84346DF20C133B41CDAFB858
- MD5 SHA1 SHA512 SSDEEP TLSH
red4ext/plugins/NightCoop/NightCoop.dll
- IMPHASH 13b84021857112511f0a7803c8b8c4d9
- SHA256 65960e5926108e8de9dfd46476a10752f1ad7b8891152c81fd30af21dfa21a6f
- MD5 72f89a1a89e27a76af5542464b76fcb2
- SHA1 ab3bfd7abe4861022445af3f6d18d416e9fcc1ea
- SHA512 1b028f0039bc288e7fd0ead8f9751fecab44e94c359769178b9f4032e7da467f9c6869262f8feb8b2ef4027fd58230241abe6f8bfb9336b8e14558c986bc09b8
- SSDEEP 98304:W27ZZKn+5syVNA8Qya1Xw5peUUXS40S3Ucqi8iifpfP1zI9hnsDmhiuDLifwvS:W4ZZG+5s8NA8pww5YUUd00eGiuDkw
- TLSH T1FA177D3661A401FCC07AD0F6961B7E23F772744903347ADB02D415B22F6AAF8977EA91
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
11987616
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ws2_32
ntohs
htons
htonl
ntohl
__WSAFDIsSet
inet_ntop
inet_pton
WSAIoctl
WSASendTo
WSARecvFrom
WSAGetLastError
WSACleanup
WSAStartup
gethostbyname
socket
setsockopt
select
inet_ntoa
getsockname
ioctlsocket
connect
closesocket
bind
winmm
timeEndPeriod
timeBeginPeriod
timeGetTime
user32
GetForegroundWindow
IsIconic
IsWindow
GetWindowLongPtrW
CloseClipboard
FindWindowExW
MapVirtualKeyW
GetKeyNameTextW
MapVirtualKeyExW
GetKeyState
EmptyClipboard
GetClipboardData
SetClipboardData
GetWindowThreadProcessId
OpenClipboard
GetKeyboardLayout
ToUnicodeEx
GetAsyncKeyState
MessageBoxA
MessageBoxW
shell32
SHGetKnownFolderPath
ole32
CoTaskMemAlloc
CoTaskMemFree
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegGetValueW
bcrypt
BCryptGenRandom
kernel32
SetStdHandle
HeapReAlloc
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
ReadConsoleW
SetFilePointerEx
ReadFile
GetConsoleMode
GetConsoleOutputCP
GetFileType
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
HeapSize
UnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
HeapAlloc
HeapFree
ExitProcess
FreeLibraryAndExitThread
FreeLibrary
ExitThread
IsProcessorFeaturePresent
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
InterlockedFlushSList
RtlUnwindEx
RaiseException
RtlPcToFileHeader
WriteConsoleW
SetEndOfFile
GetCPInfo
LCMapStringEx
DecodePointer
GetDateFormatW
GetModuleHandleA
EncodePointer
DeleteCriticalSection
GetCurrentThread
GetThreadTimes
GetModuleHandleW
LoadResource
LockResource
SizeofResource
FindResourceW
RtlLookupFunctionEntry
RtlVirtualUnwind
CreateDirectoryW
CreateFileW
FlushFileBuffers
WriteFile
CloseHandle
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
Sleep
GetCurrentProcess
GetCurrentThreadId
GetLocalTime
ReadProcessMemory
GetModuleFileNameW
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
DeleteFileW
GetFileSizeEx
GetLastError
SetEvent
WaitForSingleObject
CreateEventW
GetCurrentProcessId
TerminateProcess
CreateThread
OpenThread
SetThreadPriority
SuspendThread
ResumeThread
GetThreadContext
VirtualQuery
GetProcAddress
LoadLibraryW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
Module32FirstW
Module32NextW
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalMemoryStatusEx
GetSystemInfo
QueryThreadCycleTime
LocalFree
GetProcessIoCounters
K32GetModuleInformation
K32GetProcessMemoryInfo
SwitchToThread
GetTickCount64
RtlCaptureStackBackTrace
RtlUnwind
GetFileAttributesW
GetFullPathNameW
MoveFileExW
VirtualProtect
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
GetCommandLineW
DisableThreadLibraryCalls
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
SetUnhandledExceptionFilter
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
SetFileInformationByHandle
SetFileTime
CreateFile2
AreFileApisANSI
CopyFile2
GetFileInformationByHandleEx
GetSystemTimePreciseAsFileTime
WaitForSingleObjectEx
GetExitCodeThread
GetLogicalProcessorInformationEx
ReleaseSRWLockShared
AcquireSRWLockShared
TryAcquireSRWLockExclusive
WakeConditionVariable
FormatMessageA
GetLocaleInfoEx
GetStringTypeW
InitOnceBeginInitialize
InitOnceComplete
SetLastError
LoadLibraryExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
Main
NightCoopAddonApi
PostRegisterTypes
Query
RegisterTypes
Supports
Name
.text
Size
12.1MB
Virtual Size
12.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4.5MB
Virtual Size
4.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1.2MB
Virtual Size
20.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
318KB
Virtual Size
317KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=33145,
count=66, id=260, version=33145,
count=33, id=259, version=33145,
count=12, id=259, version=35721,
count=14, id=260, version=35721,
count=100, id=261, version=35721,
count=1, id=262, version=33145,
count=237, id=1, productName=Unmarked objects,
count=17, id=257, version=33145,
count=9, id=260, version=36260,
count=129, id=261, version=36260,
count=1, id=256, version=36260,
count=1, id=258, version=36260,