05b647cf443bbb2851059d0d0d19fb450fd8096ab453df84c464bf5a9c99e563[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
05b647cf443bbb2851059d0d0d19fb450fd8096ab453df84c464bf5a9c99e563.zip
Size 16.0MB
Sample261113-smrdfacz7x
SHA256 a07c9612caa57728c4c299399f1ccaf0ebedb56d609a80e96cbdfba4fddfd5a6
MD5 408e182a391a49d7139450d67c0cd4c3
SHA1 b135c98973fd480b085eaf9336f44611c3c7ea20
SHA512 8e30b50b00f49e10b2c1b52f352484f2b8d9489e67384029e40d5b9f243b6d12577a7121f3d3a05de3eda37c5e03c96b9a18b5a944fa1f94532fd338c6d9df43
SSDEEP 393216:A+sASqf0JVpzk2F6ewMVesmjb8+jTnnOdNxuafEkXwVuWW:AZpz1wMA1/8+XSPf5XbWW
TLSH
T10BF633EF953C8383A211536B9484F45F92B71AADB1E3CDAA441C4B7A0B7895B31F844F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Custom signature

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/05b647cf443bbb2851059d0d0d19fb450fd8096ab453df84c464bf5a9c99e563	suspicious_telegram_bot

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/05b647cf443bbb2851059d0d0d19fb450fd8096ab453df84c464bf5a9c99e563

File Explorer

05b647cf443bbb2851059d0d0d19fb450fd8096ab453df84c464bf5a9c99e563.zip

.zip 16.0MB
05b647cf443bbb2851059d0d0d19fb450fd8096ab453df84c464bf5a9c99e563

.dll 39.5MB

05b647cf443bbb2851059d0d0d19fb450fd8096ab453df84c464bf5a9c99e563.zip

SHA256 a07c9612caa57728c4c299399f1ccaf0ebedb56d609a80e96cbdfba4fddfd5a6
MD5 408e182a391a49d7139450d67c0cd4c3
SHA1 b135c98973fd480b085eaf9336f44611c3c7ea20
SHA512 8e30b50b00f49e10b2c1b52f352484f2b8d9489e67384029e40d5b9f243b6d12577a7121f3d3a05de3eda37c5e03c96b9a18b5a944fa1f94532fd338c6d9df43
SSDEEP 393216:A+sASqf0JVpzk2F6ewMVesmjb8+jTnnOdNxuafEkXwVuWW:AZpz1wMA1/8+XSPf5XbWW
TLSH
T10BF633EF953C8383A211536B9484F45F92B71AADB1E3CDAA441C4B7A0B7895B31F844F
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

05b647cf443bbb2851059d0d0d19fb450fd8096ab453df84c464bf5a9c99e563

IMPHASH 007d1ba28e6b63a0d7aec21128502483
SHA256 05b647cf443bbb2851059d0d0d19fb450fd8096ab453df84c464bf5a9c99e563
MD5 d5bf0e4110a824dcac7563c793f0139c
SHA1 b8759d879cd33a3a2db71c3ec4f839c17a0eb764
SHA512 8ee13638dd2b6fb62258a5201dd029b0505d5c9af85ad470df207a59c6e5ec83d9b3ae8f00689512df2585a3a96f1b027b14b359634710aff8d1ea8000f0ee42
SSDEEP 393216:rQnUB6DWZIkvtlIhIaOd2LJ51/YqiEiEkMS/KqiYy41ETH9e29ua+kz1BZ0gfO98:rQAZ+RZOpdPPZzk
TLSH
T1B2977C46F36251A8C02AE178835B6A33FA717C8D43356BEB17D44A213E62BD05B3F794
MD5 SHA1 SHA512 SSDEEP TLSH

Detect suspicious telegram bot

Detect suspicious telegram bot.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

Password

infected

PE Signature issue

Digest

7a:5c:0c:f2:ee:69:be:a4:51:87:b1:72:42:36:e2:9d:56:8b:4e:20:72:ce:a1:22:b6:7e:d6:92:34:5d:3d:83

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=53481265A,CN=PURSLANE,O=PURSLANE,ST=North West,C=SG,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13025347

Chains

Nov 9, 2026

SERIALNUMBER=53481265A,CN=PURSLANE,O=PURSLANE,ST=North West,C=SG,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13025347

Subject

SERIALNUMBER=53481265A,CN=PURSLANE,O=PURSLANE,ST=North West,C=SG,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13025347

Serial Number

79:1e:01:e2:77:1b:0f:0b:68:94:6e:42:93:0d:86:a1

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 5, 2026 - Feb 22, 2028

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Minor OS version

Major OS version

Entry point

26956100

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

sas

SendSAS

newdev

UpdateDriverForPlugAndPlayDevicesW

wtsapi32

WTSEnumerateSessionsA WTSQuerySessionInformationW WTSFreeMemory WTSQuerySessionInformationA

kernel32

GetSystemTimeAsFileTime GetCurrentThread SwitchToThread GetFullPathNameW GetProcessAffinityMask CreatePipe MoveFileExA GetNamedPipeInfo GetFileType WriteFile TlsGetValue TlsSetValue CreateProcessW DeleteProcThreadAttributeList ExitThread PeekNamedPipe FlsAlloc GetProcAddress LoadLibraryExA UpdateProcThreadAttribute FlsGetValue InitializeProcThreadAttributeList ExpandEnvironmentStringsW VirtualQuery GetTimeZoneInformationForYear ResumeThread QueueUserAPC VirtualAllocEx FlsSetValue OpenFileMappingW GlobalFree GlobalLock GetNamedPipeServerSessionId GlobalUnlock GetNamedPipeServerProcessId GetNamedPipeClientProcessId GlobalSize Process32NextW Process32FirstW CreateToolhelp32Snapshot GlobalAlloc CreateMutexA ReleaseMutex GetOverlappedResult ConnectNamedPipe CreateEventW CreateNamedPipeW CreateEventA DeviceIoControl GetNativeSystemInfo CreateMutexW ResetEvent GetLogicalProcessorInformation WakeAllConditionVariable InitOnceComplete InitializeSRWLock SetFilePointerEx SetFilePointer InitOnceBeginInitialize QueryFullProcessImageNameW OpenProcess GetFileTime GetFileSizeEx GetFileSize GetCurrentProcessId FlsFree MoveFileExW GetFileAttributesW GetExitCodeProcess FindFirstFileW CompareFileTime GetSystemDirectoryW SleepConditionVariableSRW HeapSize HeapQueryInformation SetEndOfFile CreateDirectoryW GetVolumeInformationByHandleW CreateFileW SetFileInformationByHandle FindFirstFileExW GetCommandLineA GetProcessId GetCurrentProcess VirtualQueryEx FindClose FindNextFileW TlsAlloc GetFileInformationByHandle TerminateProcess SetEvent SystemTimeToTzSpecificLocalTime SetLastError InitializeConditionVariable WakeConditionVariable CreateSemaphoreW WaitForSingleObjectEx SetThreadPriority IsDebuggerPresent EncodePointer DecodePointer RtlPcToFileHeader Sleep DuplicateHandle LocalFree GetCurrentDirectoryW GetCurrentThreadId ReleaseSemaphore GetLastError CloseHandle FlushFileBuffers ReadFile WaitForMultipleObjectsEx WaitForSingleObject TryAcquireSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockShared VirtualProtect ReleaseSRWLockExclusive AcquireSRWLockExclusive UnmapViewOfFile HeapFree HeapAlloc GetProcessHeap MapViewOfFile CreateFileMappingW GetSystemInfo RaiseException RtlUnwind OutputDebugStringW FormatMessageW IsProcessorFeaturePresent FormatMessageA FreeLibrary WriteProcessMemory VerifyVersionInfoW LocalAlloc CreateThread VerSetConditionMask CreateSemaphoreA GetStartupInfoW TlsFree UnhandledExceptionFilter GetStringTypeW InitializeSListHead GetLocaleInfoEx LCMapStringEx GetCPInfo InterlockedFlushSList RtlUnwindEx InitializeCriticalSectionAndSpinCount FreeLibraryAndExitThread GetConsoleOutputCP CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation SetStdHandle IsValidCodePage GetACP SetUnhandledExceptionFilter DeleteFileW GetTempPathW ReadConsoleW GetWindowsDirectoryW WaitForMultipleObjects ReadFileEx ExitProcess CancelIo CopyFileExW GetFinalPathNameByHandleW RemoveDirectoryW GetOEMCP HeapReAlloc SleepEx WriteFileEx GetCommandLineW SetEnvironmentVariableW GetEnvironmentVariableW GetEnvironmentStringsW SetWaitableTimer CreateWaitableTimerExW SetThreadStackGuarantee CompareStringOrdinal FreeEnvironmentStringsW CancelIoEx SetFileCompletionNotificationModes GetQueuedCompletionStatusEx CreateIoCompletionPort PostQueuedCompletionStatus SetHandleInformation GetProcessIoCounters GetSystemTimes GetDriveTypeW GetLogicalProcessorInformationEx GetProcessTimes K32GetPerformanceInfo GlobalMemoryStatusEx GetTickCount64 SetConsoleMode GetFileInformationByHandleEx GetComputerNameExW SetFileTime RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetLogicalDrives WideCharToMultiByte SetThreadErrorMode InitializeCriticalSection SetInformationJobObject AssignProcessToJobObject CreateJobObjectW SetConsoleTextAttribute GetConsoleScreenBufferInfo WriteConsoleW GetConsoleMode GetStdHandle TryEnterCriticalSection SleepConditionVariableCS LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSectionEx FileTimeToSystemTime SetErrorMode MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency GetModuleFileNameW GetModuleHandleExW ReadProcessMemory lstrcmpiW GetUserPreferredUILanguages lstrlenW SetConsoleCtrlHandler GetModuleHandleA WTSGetActiveConsoleSessionId GetModuleHandleW LoadLibraryA SetDllDirectoryW LoadLibraryExW ProcessIdToSessionId LoadLibraryW SetThreadExecutionState GetModuleHandleExA

crypt32

CertAddCertificateContextToStore CertOpenStore CertCloseStore CertDuplicateStore CertGetEnhancedKeyUsage CertVerifyTimeValidity CertEnumCertificatesInStore CertVerifyCertificateChainPolicy CertGetCertificateChain CertDuplicateCertificateChain CertFreeCertificateChain CertDuplicateCertificateContext CertFreeCertificateContext

advapi32

LookupAccountSidW ImpersonateAnonymousToken RevertToSelf SetSecurityDescriptorDacl RegCloseKey RegDeleteKeyW RegEnumKeyExW RegQueryValueExW InitializeSecurityDescriptor CreateProcessWithLogonW RegQueryInfoKeyW RegEnumValueW RegDeleteValueW GetAce ConvertStringSecurityDescriptorToSecurityDescriptorW RegDeleteTreeW AdjustTokenPrivileges DuplicateTokenEx ImpersonateLoggedOnUser LookupPrivilegeValueW CreateProcessWithTokenW GetTokenInformation IsWellKnownSid LogonUserW DuplicateToken AllocateAndInitializeSid CreateWellKnownSid ConvertSidToStringSidW GetLengthSid FreeSid EqualSid OpenProcessToken SetNamedSecurityInfoW SetEntriesInAclW GetSecurityInfo GetNamedSecurityInfoW CreateProcessAsUserW ConvertStringSidToSidW RegSetValueExW RegOpenKeyExW StartServiceCtrlDispatcherW CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatusEx SetServiceStatus GetUserNameW SystemFunction036 IsValidSid CopySid RegisterServiceCtrlHandlerExW

oleaut32

GetErrorInfo SysStringLen SysFreeString SetErrorInfo

secur32

QueryContextAttributesW DeleteSecurityContext FreeCredentialsHandle AcquireCredentialsHandleA AcceptSecurityContext ApplyControlToken FreeContextBuffer InitializeSecurityContextW DecryptMessage EncryptMessage

user32

GetWindowRect LoadCursorW SetCursor SetWindowPlacement GetWindowPlacement DispatchMessageW GetMessageW PostMessageW DefWindowProcA UnhookWindowsHookEx SetWindowPos DispatchMessageA TranslateMessage GetMessageA SetWindowsHookExA GetWindowThreadProcessId GetForegroundWindow GetCursorInfo ScreenToClient EnumWindows GetCursorPos GetAsyncKeyState GetUserObjectInformationA GetThreadDesktop CloseDesktop SetThreadDesktop OpenInputDesktop ExitWindowsEx RegisterClassW EnumDisplaySettingsExW EnumDisplayDevicesW GetMonitorInfoA EnumDisplayMonitors GetKeyState RegisterTouchWindow GetDoubleClickTime GetMenuItemInfoW SendMessageW GetDisplayConfigBufferSizes QueryDisplayConfig DisplayConfigGetDeviceInfo MapWindowPoints SetCursorPos GetSystemMetrics OffsetRect IsWindowVisible GetWindowTextLengthW GetWindowTextW SetWindowTextW AttachThreadInput IsClipboardFormatAvailable EmptyClipboard GetClipboardFormatNameA CountClipboardFormats RegisterClipboardFormatW RegisterClipboardFormatA FindWindowW GetClipboardData SetClipboardData ChangeClipboardChain SetClipboardViewer GetClipboardOwner ShowWindow SetForegroundWindow MessageBoxW GetClipboardSequenceNumber CloseClipboard OpenClipboard RegisterClassExA VkKeyScanExW RemoveClipboardFormatListener GetWindowDC FindWindowExA ToUnicodeEx GetKeyboardLayout EnumDisplaySettingsW GetWindowLongW DefWindowProcW BlockInput AllowSetForegroundWindow CreateWindowExW IsWindow PostThreadMessageA CallNextHookEx ReleaseDC ClipCursor LockWorkStation GetDC DestroyWindow AddClipboardFormatListener MapVirtualKeyExW RedrawWindow GetDesktopWindow LoadCursorA GetIconInfo ValidateRect CreateWindowExA GetKeyboardState GetRawInputData ReleaseCapture ShowCursor GetClipCursor SetWindowLongW GetSystemMenu SetWindowDisplayAffinity SystemParametersInfoW MsgWaitForMultipleObjectsEx SetCapture SetPropW AdjustWindowRectEx PostQuitMessage SystemParametersInfoA CreateAcceleratorTableW RegisterRawInputDevices RegisterClassExW SendInput GetActiveWindow PostThreadMessageW DestroyAcceleratorTable IsProcessDPIAware CheckMenuItem EnableMenuItem AppendMenuW InvalidateRgn ChangeDisplaySettingsExW GetUpdateRect InsertMenuW CreatePopupMenu CreateMenu DestroyMenu MapVirtualKeyW GetMonitorInfoW GetMenuBarInfo GetMenu SetMenu SetMenuItemInfoW DrawMenuBar RemoveMenu DrawIconEx TrackPopupMenu MonitorFromWindow DrawTextW SetTimer KillTimer SetWindowLongPtrW GetWindowLongPtrW CloseTouchInputHandle PeekMessageW GetTouchInputInfo ChangeWindowMessageFilterEx TrackMouseEvent ClientToScreen CreateIcon DestroyIcon RegisterWindowMessageA wsprintfW GetClientRect SendMessageA FillRect PostMessageA MonitorFromRect

shell32

Shell_NotifyIconGetRect SHAddToRecentDocs DragQueryFileW DragFinish ShellExecuteW ShellExecuteExW SHAppBarMessage SHGetKnownFolderPath ShellExecuteA CommandLineToArgvW Shell_NotifyIconW

comctl32

SetWindowSubclass RemoveWindowSubclass DefSubclassProc

ntdll

RtlNtStatusToDosError NtDeviceIoControlFile NtReadFile NtQuerySystemInformation NtQueryInformationProcess NtWriteFile RtlDosPathNameToNtPathName_U_WithStatus NtCreateFile RtlGetVersion RtlFreeUnicodeString RtlGetNtVersionNumbers NtCancelIoFileEx

ole32

OleSetClipboard OleGetClipboard ReleaseStgMedium RegisterDragDrop StringFromGUID2 CoTaskMemAlloc CoCreateGuid OleInitialize OleIsCurrentClipboard OleUninitialize PropVariantClear CoCreateInstance CoInitializeEx RevokeDragDrop CoUninitialize CoTaskMemFree

shlwapi

SHCreateMemStream

userenv

GetUserProfileDirectoryW CreateEnvironmentBlock DestroyEnvironmentBlock

ws2_32

accept connect listen getsockname getpeername WSASocketW send recv WSAGetLastError getsockopt WSAStartup shutdown recvfrom sendto setsockopt WSAIoctl WSASend socket closesocket WSACleanup freeaddrinfo getaddrinfo ioctlsocket bind

gdi32

SetBkMode SetTextColor CreateDIBitmap GetDeviceCaps CreateDIBSection CreateDCW DeleteObject GetDIBits CreateCompatibleBitmap CreateRectRgn CreateSolidBrush DeleteDC SelectObject CreateCompatibleDC GetBitmapBits GetObjectA BitBlt

winspool.drv

DeletePrinterDriverExW DeletePrinterDriverPackageW EnumPortsW EnumPrinterDriversW XcvDataW ClosePrinter SetPrinterW DeletePrinter UploadPrinterDriverPackageW InstallPrinterDriverFromPackageW AddPrinterW GetDefaultPrinterW EnumPrintersW OpenPrinterW

setupapi

SetupDiGetClassDevsExW SetupDiGetDeviceInterfaceDetailW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetDeviceInstallParamsW SetupDiSetClassInstallParamsW SetupDiGetINFClassW SetupDiCreateDeviceInfoList SetupDiCreateDeviceInfoW SetupDiGetDeviceRegistryPropertyW SetupDiSetDeviceRegistryPropertyW SetupDiCallClassInstaller SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiGetDeviceInfoListDetailW

dwmapi

DwmEnableBlurBehindWindow

cfgmgr32

CM_Get_DevNode_Status

iphlpapi

GetAdaptersAddresses SendARP GetBestInterface

powrprof

CallNtPowerInformation

dxgi

CreateDXGIFactory1

d3d11

D3D11CreateDevice

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptGenRandom

pdh

PdhCollectQueryData PdhCloseQuery PdhCollectQueryDataEx PdhOpenQueryA PdhGetFormattedCounterValue PdhRemoveCounter PdhAddEnglishCounterW PdhAddEnglishCounterA

psapi

GetModuleFileNameExW GetProcessMemoryInfo

drop_dart_object free_WireSyncReturn free_c_args free_zero_copy_buffer_f32 free_zero_copy_buffer_f64 free_zero_copy_buffer_i16 free_zero_copy_buffer_i32 free_zero_copy_buffer_i64 free_zero_copy_buffer_i8 free_zero_copy_buffer_u16 free_zero_copy_buffer_u32 free_zero_copy_buffer_u64 free_zero_copy_buffer_u8 get_dart_object get_rustdesk_app_name hwcodec_av_log_callback hwcodec_log init_frb_dart_api_dl new_StringList_0 new_dart_opaque new_int_32_list_0 new_uint_8_list_0 privacy_mode_hook_keyboard privacy_mode_hook_mouse rustdesk_core_main_args rustdesk_is_disable_installation session_get_rgba store_dart_post_cobject wire_cm_can_elevate wire_cm_check_click_time wire_cm_check_clients_length wire_cm_close_connection wire_cm_close_connection_window wire_cm_close_voice_call wire_cm_elevate_portable wire_cm_get_click_time wire_cm_get_clients_length wire_cm_get_clients_state wire_cm_get_config wire_cm_handle_incoming_voice_call wire_cm_init wire_cm_login_res wire_cm_remove_disconnected_connection wire_cm_send_chat wire_cm_switch_back wire_cm_switch_permission wire_get_double_click_time wire_get_local_flutter_option wire_get_local_kb_layout_type wire_get_next_texture_key wire_get_voice_call_input_device wire_host_stop_system_key_propagate wire_install_install_me wire_install_install_options wire_install_install_path wire_install_run_without_install wire_install_show_run_without_install wire_is_custom_client wire_is_disable_ab wire_is_disable_account wire_is_disable_group_panel wire_is_disable_installation wire_is_disable_settings wire_is_incoming_only wire_is_outgoing_only wire_is_preset_password wire_is_preset_password_mobile_only wire_is_selinux_enforcing wire_is_support_multi_ui_session wire_main_account_auth wire_main_account_auth_cancel wire_main_account_auth_result wire_main_audio_support_loopback wire_main_change_id wire_main_change_language wire_main_change_theme wire_main_check_connect_status wire_main_check_hwcodec wire_main_check_mouse_time wire_main_check_super_user_permission wire_main_clear_ab wire_main_clear_group wire_main_clear_trusted_devices wire_main_clip_cursor wire_main_create_shortcut wire_main_current_is_wayland wire_main_default_privacy_mode_impl wire_main_deploy_device wire_main_device_id wire_main_device_name wire_main_discover wire_main_forget_password wire_main_generate2fa wire_main_get_api_server wire_main_get_app_name wire_main_get_app_name_sync wire_main_get_async_status wire_main_get_build_date wire_main_get_buildin_option wire_main_get_common wire_main_get_common_sync wire_main_get_connect_status wire_main_get_data_dir_ios wire_main_get_default_keyboard_shortcuts wire_main_get_displays wire_main_get_env wire_main_get_error wire_main_get_fav wire_main_get_fingerprint wire_main_get_hard_option wire_main_get_home_dir wire_main_get_http_status wire_main_get_input_source wire_main_get_lan_peers wire_main_get_langs wire_main_get_last_remote_id wire_main_get_license wire_main_get_local_option wire_main_get_login_device_info wire_main_get_main_display wire_main_get_mouse_time wire_main_get_my_id wire_main_get_new_stored_peers wire_main_get_new_version wire_main_get_option wire_main_get_option_sync wire_main_get_options wire_main_get_options_sync wire_main_get_peer_flutter_option_sync wire_main_get_peer_option wire_main_get_peer_option_sync wire_main_get_peer_sync wire_main_get_printer_names wire_main_get_proxy_status wire_main_get_socks wire_main_get_software_update_url wire_main_get_sound_inputs wire_main_get_temporary_password wire_main_get_trusted_devices wire_main_get_unlock_pin wire_main_get_use_texture_render wire_main_get_user_default_option wire_main_get_uuid wire_main_get_version wire_main_goto_install wire_main_handle_relay_id wire_main_handle_wayland_screencast_restore_token wire_main_has_file_clipboard wire_main_has_gpu_texture_render wire_main_has_hwcodec wire_main_has_valid_2fa_sync wire_main_has_valid_bot_sync wire_main_has_vram wire_main_hide_dock wire_main_http_request wire_main_init wire_main_init_input_source wire_main_is_can_input_monitoring wire_main_is_can_screen_recording wire_main_is_installed wire_main_is_installed_daemon wire_main_is_installed_lower_version wire_main_is_login_wayland wire_main_is_option_fixed wire_main_is_process_trusted wire_main_is_root wire_main_is_share_rdp wire_main_is_using_public_server wire_main_load_ab wire_main_load_fav_peers wire_main_load_group wire_main_load_lan_peers wire_main_load_recent_peers wire_main_load_recent_peers_for_ab wire_main_max_encrypt_len wire_main_on_main_window_close wire_main_peer_exists wire_main_peer_has_password wire_main_reload_keyboard_shortcuts wire_main_remove_discovered wire_main_remove_peer wire_main_remove_trusted_devices wire_main_renew_trusted_devices wire_main_resolve_avatar_url wire_main_save_ab wire_main_save_group wire_main_set_common wire_main_set_cursor_position wire_main_set_env wire_main_set_home_dir wire_main_set_input_source wire_main_set_local_option wire_main_set_option wire_main_set_options wire_main_set_peer_alias wire_main_set_peer_flutter_option_sync wire_main_set_peer_option wire_main_set_peer_option_sync wire_main_set_permanent_password_with_result wire_main_set_share_rdp wire_main_set_socks wire_main_set_unlock_pin wire_main_set_user_default_option wire_main_start_dbus_server wire_main_start_ipc_url_server wire_main_start_service wire_main_stop_service wire_main_store_fav wire_main_support_remove_wallpaper wire_main_supported_hwdecodings wire_main_supported_input_source wire_main_supported_privacy_mode_impls wire_main_test_if_valid_server wire_main_test_wallpaper wire_main_update_me wire_main_update_temporary_password wire_main_uri_prefix_sync wire_main_verify2fa wire_main_verify_bot wire_main_video_save_directory wire_main_wol wire_option_synced wire_peer_get_sessions_count wire_query_onlines wire_send_url_scheme wire_session_add_existed_sync wire_session_add_job wire_session_add_port_forward wire_session_add_sync wire_session_alternative_codecs wire_session_cancel_job wire_session_change_prefer_codec wire_session_change_resolution wire_session_close wire_session_close_terminal wire_session_close_voice_call wire_session_create_dir wire_session_ctrl_alt_del wire_session_elevate_direct wire_session_elevate_with_logon wire_session_enter_or_leave wire_session_get_audit_guid wire_session_get_audit_server_sync wire_session_get_common wire_session_get_common_sync wire_session_get_conn_session_id wire_session_get_conn_token wire_session_get_cursor_shape wire_session_get_custom_image_quality wire_session_get_displays_as_individual_windows wire_session_get_edge_scroll_edge_thickness wire_session_get_enable_trusted_devices wire_session_get_flutter_option wire_session_get_image_quality wire_session_get_is_recording wire_session_get_keyboard_mode wire_session_get_last_audit_note wire_session_get_option wire_session_get_peer_option wire_session_get_platform wire_session_get_remember wire_session_get_reverse_mouse_wheel_sync wire_session_get_rgba_size wire_session_get_scroll_style wire_session_get_toggle_option wire_session_get_toggle_option_sync wire_session_get_trackpad_speed wire_session_get_use_all_my_displays_for_the_remote_session wire_session_get_view_style wire_session_handle_flutter_key_event wire_session_handle_flutter_raw_key_event wire_session_handle_screenshot wire_session_input_key wire_session_input_os_password wire_session_input_string wire_session_is_keyboard_mode_supported wire_session_is_multi_ui_session wire_session_load_last_transfer_jobs wire_session_lock_screen wire_session_login wire_session_new_rdp wire_session_next_rgba wire_session_on_waiting_for_image_dialog_show wire_session_open_terminal wire_session_peer_option wire_session_printer_response wire_session_read_dir_to_remove_recursive wire_session_read_local_dir_sync wire_session_read_local_empty_dirs_recursive_sync wire_session_read_remote_dir wire_session_read_remote_empty_dirs_recursive_sync wire_session_reconnect wire_session_record_screen wire_session_refresh wire_session_register_gpu_texture wire_session_register_pixelbuffer_texture wire_session_remove_all_empty_dirs wire_session_remove_file wire_session_remove_port_forward wire_session_rename_file wire_session_request_new_display_init_msgs wire_session_request_voice_call wire_session_resize_terminal wire_session_restart_remote_device wire_session_resume_job wire_session_send2fa wire_session_send_chat wire_session_send_files wire_session_send_mouse wire_session_send_note wire_session_send_pointer wire_session_send_selected_session_id wire_session_send_terminal_input wire_session_set_audit_guid wire_session_set_common wire_session_set_confirm_override_file wire_session_set_custom_fps wire_session_set_custom_image_quality wire_session_set_displays_as_individual_windows wire_session_set_edge_scroll_edge_thickness wire_session_set_flutter_option wire_session_set_image_quality wire_session_set_keyboard_mode wire_session_set_reverse_mouse_wheel wire_session_set_scroll_style wire_session_set_size wire_session_set_trackpad_speed wire_session_set_use_all_my_displays_for_the_remote_session wire_session_set_view_style wire_session_start wire_session_start_with_displays wire_session_switch_display wire_session_switch_sides wire_session_take_screenshot wire_session_toggle_option wire_session_toggle_privacy_mode wire_session_toggle_virtual_display wire_set_cur_session_id wire_set_local_flutter_option wire_set_local_kb_layout_type wire_set_voice_call_input_device wire_start_global_event_stream wire_stop_global_event_stream wire_translate wire_version_to_number wire_will_session_close_close_session

Name

.text

Size

26.4MB

Virtual Size

26.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12.3MB

Virtual Size

12.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

52KB

Virtual Size

558KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

524KB

Virtual Size

523KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

328KB

Virtual Size

327KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

05b647cf443bbb2851059d0d0d19fb450fd8096ab453df84c464bf5a9c99e563.zip

05b647cf443bbb2851059d0d0d19fb450fd8096ab453df84c464bf5a9c99e563

PE Signature issue

sas

newdev

wtsapi32

kernel32

crypt32

advapi32

oleaut32

secur32

user32

shell32

comctl32

ntdll

ole32

shlwapi

userenv

ws2_32

gdi32

winspool.drv

setupapi

dwmapi

cfgmgr32

iphlpapi

powrprof

dxgi

d3d11

bcrypt

pdh

psapi

generic