{"id":1009,"date":"2012-06-05T18:57:35","date_gmt":"2012-06-05T18:57:35","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=1009"},"modified":"2012-07-05T15:10:00","modified_gmt":"2012-07-05T15:10:00","slug":"hexdive-preview-of-a-new-tool-2","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2012\/06\/05\/hexdive-preview-of-a-new-tool-2\/","title":{"rendered":"HexDive \u2013 Preview of a new tool (2)"},"content":{"rendered":"<p>I thought I will show some more output from the tool &#8211; these are malware-specific APIs only (tool outputs more stuff).<\/p>\n<p>atm it&#8217;s over 70,000 keywords searched using modified Aho-Corasick algorithm:<\/p>\n<p><strong>Flame memory dump (partial)<br \/>\n<\/strong><\/p>\n<p><strong><\/strong>A|mal-api|-|NtQueryInformationProcess<br \/>\nA|mal-api|-|select<br \/>\nA|mal-api|-|bind<br \/>\nA|mal-api|-|WSAAccept<br \/>\nA|mal-api|-|WSAIoctl<br \/>\nA|mal-api|-|EnumProcesses<br \/>\nA|mal-api|-|OpenProcessToken<br \/>\nA|mal-api|-|OpenThreadToken<br \/>\nA|mal-api|-|LookupPrivilegeValueW<br \/>\nA|mal-api|-|AdjustTokenPrivileges<br \/>\nA|mal-api|-|CreateProcessAsUserW<br \/>\nA|mal-api|-|ImpersonateLoggedOnUser<br \/>\nA|mal-api|-|RegCloseKey<br \/>\nA|mal-api|-|RegSetValueExW<br \/>\nA|mal-api|-|RegSetValueExA<br \/>\nA|mal-api|-|GetUserNameA<br \/>\nA|mal-api|-|CreateProcessWithLogonW<br \/>\nA|mal-api|-|GetUserNameW<br \/>\nA|mal-api|-|RasEnumConnectionsW<br \/>\nA|mal-api|-|NdrClientCall2<br \/>\nA|mal-api|-|FindWindowA<br \/>\nA|mal-api|-|WSASend<br \/>\nA|mal-api|-|WSARecv<br \/>\nA|mal-api|-|CloseServiceHandle<br \/>\nA|mal-api|-|DeleteService<br \/>\nA|mal-api|-|CreateServiceA<br \/>\nA|mal-api|-|StartServiceA<br \/>\nA|mal-api|-|ControlService<br \/>\nA|mal-api|-|CreateThread<br \/>\nA|mal-api|-|CreateMutexA<br \/>\nA|mal-api|-|CreateMutexW<br \/>\nA|mal-api|-|SetEnvironmentVariableW<br \/>\nA|mal-api|-|VirtualAllocEx<br \/>\nA|mal-api|-|ReadProcessMemory<br \/>\nA|mal-api|-|OpenProcess<br \/>\nA|mal-api|-|Sleep<br \/>\nA|mal-api|-|WriteFile<br \/>\nA|mal-api|-|FindFirstFileW<br \/>\nA|mal-api|-|CreateFileW<br \/>\nA|mal-api|-|GetModuleHandleW<br \/>\nA|mal-api|-|GetModuleFileNameW<br \/>\nA|mal-api|-|GetModuleHandleA<br \/>\nA|mal-api|-|VirtualProtect<br \/>\nA|mal-api|-|GetVersion<br \/>\nA|mal-api|-|GetSystemDirectoryW<br \/>\nA|mal-api|-|ExitThread<br \/>\nA|mal-api|-|GetThreadTimes<br \/>\nA|mal-api|-|GetThreadContext<br \/>\nA|mal-api|-|OpenThread<br \/>\nA|mal-api|-|GetProcAddress<br \/>\nA|mal-api|-|SetThreadContext<br \/>\nA|mal-api|-|GetTempPathW<br \/>\nA|mal-api|-|GetTempFileNameW<br \/>\nA|mal-api|-|GetFileAttributesW<br \/>\nA|mal-api|-|LoadLibraryW<br \/>\nA|mal-api|-|CreateProcessW<br \/>\nA|mal-api|-|DeleteFileW<br \/>\nA|mal-api|-|MoveFileExW<br \/>\nA|mal-api|-|Thread32First<br \/>\nA|mal-api|-|Thread32Next<br \/>\nA|mal-api|-|CreateToolhelp32Snapshot<br \/>\nA|mal-api|-|GetTickCount<br \/>\nA|mal-api|-|FindNextFileW<br \/>\nA|mal-api|-|CreateNamedPipeW<br \/>\nA|mal-api|-|DisconnectNamedPipe<br \/>\nA|mal-api|-|CreateDirectoryW<br \/>\nA|mal-api|-|LockResource<br \/>\nA|mal-api|-|GetStartupInfoW<br \/>\nA|mal-api|-|PeekNamedPipe<br \/>\nA|mal-api|-|ExitProcess<br \/>\nA|mal-api|-|FindFirstFileA<br \/>\nA|mal-api|-|FindNextFileA<br \/>\nA|mal-api|-|GetComputerNameA<br \/>\nA|mal-api|-|GetEnvironmentVariableA<br \/>\nA|mal-api|-|GetTimeZoneInformation<br \/>\nA|mal-api|-|GetComputerNameW<br \/>\nA|mal-api|-|CreateNamedPipeA<br \/>\nA|mal-api|-|CreateProcessA<br \/>\nA|mal-api|-|GetModuleFileNameA<br \/>\nA|mal-api|-|GetCommandLineA<br \/>\nA|mal-api|-|IsDebuggerPresent<br \/>\nA|mal-api|-|DeleteFileA<br \/>\nA|mal-api|-|GetStartupInfoA<br \/>\nA|mal-api|-|FreeEnvironmentStringsA<br \/>\nA|mal-api|-|FreeEnvironmentStringsW<br \/>\nA|mal-api|-|GetFileAttributesA<br \/>\nA|mal-api|-|GetStringTypeA<br \/>\nA|mal-api|-|GetStringTypeW<br \/>\nA|mal-api|-|SetEnvironmentVariableA<br \/>\nA|mal-api|-|DeviceIoControl<br \/>\nA|mal-api|-|GetSystemDirectoryA<br \/>\nA|mal-api|-|GetDriveTypeA<br \/>\nA|mal-api|-|SetThreadPriority<br \/>\nA|mal-api|-|GetDiskFreeSpaceW<br \/>\nA|mal-api|-|GetDiskFreeSpaceA<br \/>\nA|mal-api|-|GetTempPathA<br \/>\nA|mal-api|-|GetDriveTypeW<br \/>\nA|mal-api|-|FindFirstChangeNotificationW<br \/>\nA|mal-api|-|FindNextChangeNotification<br \/>\nA|mal-api|-|FindFirstVolumeW<br \/>\nA|mal-api|-|ExitThread<br \/>\nA|mal-api|-|ExitThread<br \/>\nU|mal-api|-|SLEEP<br \/>\nU|mal-api|-|SLEEP<br \/>\nU|mal-api|-|connect<br \/>\nU|mal-api|-|LoadLibraryW<br \/>\nU|mal-api|-|GetComputerNameA<br \/>\nU|mal-api|-|GetComputerNameW<br \/>\nU|mal-api|-|GetUserNameA<br \/>\nU|mal-api|-|GetUserNameW<br \/>\nU|mal-api|-|connect<br \/>\nU|mal-api|-|connect<br \/>\nU|mal-api|-|connect<br \/>\nU|mal-api|-|connect<br \/>\nU|mal-api|-|connect<br \/>\nU|mal-api|-|connect<br \/>\nU|mal-api|-|DeleteService<br \/>\nU|mal-api|-|connect<br \/>\nU|mal-api|-|DeleteService<br \/>\nU|mal-api|-|connect<br \/>\nU|mal-api|-|DeleteService<br \/>\nU|mal-api|-|connect<br \/>\nU|mal-api|-|DeleteService<br \/>\nU|mal-api|-|Connect<br \/>\nU|mal-api|-|connect<br \/>\nU|mal-api|-|Connect<br \/>\nU|mal-api|-|SLEEP<br \/>\nU|mal-api|-|Send<br \/>\nU|mal-api|-|Send<br \/>\nU|mal-api|-|Send<br \/>\nU|mal-api|-|Send<br \/>\nU|mal-api|-|Send<br \/>\nU|mal-api|-|Select<br \/>\nU|mal-api|-|SLEEP<br \/>\nU|mal-api|-|SLEEP<br \/>\nU|mal-api|-|SLEEP<br \/>\nU|mal-api|-|SLEEP<br \/>\nU|mal-api|-|SLEEP<br \/>\nU|mal-api|-|Connect<br \/>\nU|mal-api|-|connect<br \/>\nU|mal-api|-|connect<br \/>\nU|mal-api|-|select<br \/>\nU|mal-api|-|NtQuerySystemInformation<br \/>\nU|mal-api|-|RegLoadKeyW<br \/>\nU|mal-api|-|CreateToolhelp32Snapshot<br \/>\nU|mal-api|-|Process32First<br \/>\nU|mal-api|-|Process32FirstW<br \/>\nU|mal-api|-|Process32Next<br \/>\nU|mal-api|-|Process32NextW<br \/>\nA|mal-api|-|ExitThread<br \/>\nA|mal-api|-|Sleep<br \/>\nA|mal-api|-|VirtualProtect<br \/>\nA|mal-api|-|GetProcAddress<br \/>\nA|mal-api|-|GetModuleHandleA<br \/>\nA|mal-api|-|CreateMutexW<br \/>\nA|mal-api|-|NtQueryInformationProcess<br \/>\nA|mal-api|-|LoadLibraryW<br \/>\nA|mal-api|-|CreateFileW<br \/>\nU|mal-api|-|GetProcAddress<br \/>\nU|mal-api|-|GetModuleHandleA<br \/>\nU|mal-api|-|OpenThread<br \/>\nU|mal-api|-|ExitThread<br \/>\nU|mal-api|-|ExitThread<br \/>\nU|mal-api|-|GetModuleHandleW<br \/>\nA|mal-api|-|URLDownloadToFileA<br \/>\nA|mal-api|-|ExitThread<br \/>\nA|mal-api|-|SELECT<br \/>\nA|mal-api|-|bind<br \/>\nA|mal-api|-|bind<\/p>\n<p><strong>Random malware sample:<\/strong><\/p>\n<p>A|mal-api|-|CreateToolhelp32Snapshot<br \/>\nA|mal-api|-|Toolhelp32ReadProcessMemory<br \/>\nA|mal-api|-|Process32Next<br \/>\nA|mal-api|-|Process32FirstW<br \/>\nA|mal-api|-|Thread32First<br \/>\nA|mal-api|-|Thread32Next<br \/>\nA|mal-api|-|Module32First<br \/>\nA|mal-api|-|Module32Next<br \/>\nA|mal-api|-|Module32FirstW<br \/>\nA|mal-api|-|Module32NextW<br \/>\nA|mal-api|-|WSAStartup<br \/>\nA|mal-api|-|WSACleanup<br \/>\nA|mal-api|-|WSAASyncGetHostByName<br \/>\nA|mal-api|-|WSAASyncGetServByName<br \/>\nA|mal-api|-|bind<br \/>\nA|mal-api|-|listen<br \/>\nA|mal-api|-|connect<br \/>\nA|mal-api|-|WSACancelASyncRequest<br \/>\nA|mal-api|-|closesocket<br \/>\nA|mal-api|-|send<br \/>\nA|mal-api|-|recv<br \/>\nA|mal-api|-|WSACleanup<br \/>\nA|mal-api|-|accept<br \/>\nA|mal-api|-|bind<br \/>\nA|mal-api|-|closesocket<br \/>\nA|mal-api|-|connect<br \/>\nA|mal-api|-|ioctlsocket<br \/>\nA|mal-api|-|htonl<br \/>\nA|mal-api|-|htons<br \/>\nA|mal-api|-|inet_addr<br \/>\nA|mal-api|-|inet_ntoa<br \/>\nA|mal-api|-|listen<br \/>\nA|mal-api|-|ntohl<br \/>\nA|mal-api|-|ntohs<br \/>\nA|mal-api|-|recv<br \/>\nA|mal-api|-|recvfrom<br \/>\nA|mal-api|-|select<br \/>\nA|mal-api|-|send<br \/>\nA|mal-api|-|sendto<br \/>\nA|mal-api|-|setsockopt<br \/>\nA|mal-api|-|shutdown<br \/>\nA|mal-api|-|socket<br \/>\nA|mal-api|-|gethostbyaddr<br \/>\nA|mal-api|-|gethostbyname<br \/>\nA|mal-api|-|gethostname<br \/>\nA|mal-api|-|getservbyname<br \/>\nA|mal-api|-|WSASetLastError<br \/>\nA|mal-api|-|WSAAsyncGetServByName<br \/>\nA|mal-api|-|WSAAsyncGetServByPort<br \/>\nA|mal-api|-|WSAAsyncGetProtoByName<br \/>\nA|mal-api|-|WSAAsyncGetProtoByNumber<br \/>\nA|mal-api|-|WSAAsyncGetHostByName<br \/>\nA|mal-api|-|WSAAsyncGetHostByAddr<br \/>\nA|mal-api|-|WSACancelAsyncRequest<br \/>\nA|mal-api|-|WSAAsyncSelect<br \/>\nA|mal-api|-|__WSAFDIsSet<br \/>\nA|mal-api|-|WSAAccept<br \/>\nA|mal-api|-|WSACloseEvent<br \/>\nA|mal-api|-|WSAConnect<br \/>\nA|mal-api|-|WSACreateEvent<br \/>\nA|mal-api|-|WSAHtonl<br \/>\nA|mal-api|-|WSAHtons<br \/>\nA|mal-api|-|WSAIoctl<br \/>\nA|mal-api|-|WSANtohs<br \/>\nA|mal-api|-|WSARecv<br \/>\nA|mal-api|-|WSARecvFrom<br \/>\nA|mal-api|-|WSASend<br \/>\nA|mal-api|-|WSASendTo<br \/>\nA|mal-api|-|WSAWaitForMultipleEvents<br \/>\nA|mal-api|-|WSAProviderConfigChange<br \/>\nA|mal-api|-|AcceptEx<br \/>\nA|mal-api|-|WSARecvEx<br \/>\nA|mal-api|-|WSAStartup<br \/>\nA|mal-api|-|ZwQuerySystemInformation<br \/>\nA|mal-api|-|ZwOpenProcess<br \/>\nA|mal-api|-|ZwOpenSection<br \/>\nA|mal-api|-|ZwOpenFile<br \/>\nU|mal-api|-|connect<br \/>\nU|mal-api|-|connect<br \/>\nU|mal-api|-|connect<br \/>\nU|mal-api|-|connect<br \/>\nU|mal-api|-|send<br \/>\nU|mal-api|-|socket<br \/>\nU|mal-api|-|socket<br \/>\nU|mal-api|-|socket<br \/>\nU|mal-api|-|socket<br \/>\nU|mal-api|-|connect<br \/>\nU|mal-api|-|connect<br \/>\nU|mal-api|-|connect<br \/>\nU|mal-api|-|socket<br \/>\nU|mal-api|-|socket<br \/>\nU|mal-api|-|shutdown<br \/>\nU|mal-api|-|socket<br \/>\nU|mal-api|-|socket<br \/>\nU|mal-api|-|listen<br \/>\nU|mal-api|-|socket<br \/>\nU|mal-api|-|socket<br \/>\nU|mal-api|-|socket<br \/>\nA|mal-api|-|GetProcAddress<br \/>\nA|mal-api|-|GetModuleHandleA<br \/>\nA|mal-api|-|InternetReadFile<br \/>\nA|mal-api|-|StartServiceA<br \/>\nA|mal-api|-|WSACleanup<br \/>\nA|mal-api|-|WSAIoctl<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I thought I will show some more output from the tool &#8211; these are malware-specific APIs only (tool outputs more stuff). atm it&#8217;s over 70,000 keywords searched using modified Aho-Corasick algorithm: Flame memory dump (partial) A|mal-api|-|NtQueryInformationProcess A|mal-api|-|select A|mal-api|-|bind A|mal-api|-|WSAAccept A|mal-api|-|WSAIoctl &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2012\/06\/05\/hexdive-preview-of-a-new-tool-2\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[23,9,5],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/1009"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=1009"}],"version-history":[{"count":5,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/1009\/revisions"}],"predecessor-version":[{"id":1122,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/1009\/revisions\/1122"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=1009"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=1009"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=1009"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}