fe32f3156fcab3713cc24f34e188e4698ece35e2a8b0eb7db086c74d0ce5851c

Sharing

Copy URL Twitter E-mail

General

Target

fe32f3156fcab3713cc24f34e188e4698ece35e2a8b0eb7db086c74d0ce5851c
Size

212KB
MD5

7d3a97f3a48c49cfba455013b61d1140
SHA1

3ca4ff3174fa1e2e316f0a7164ae735f51b82ee3
SHA256

fe32f3156fcab3713cc24f34e188e4698ece35e2a8b0eb7db086c74d0ce5851c
SHA512

ae42f1e3280e7b7ad1a15dfc9b8d50aeb61f910f454ca72e818ec2acd320a2c3e0f9451355f82880c11e19c1419414a3e95898e309faaff932c334bb2deca8ac
SSDEEP

6144:QqnigC6jvTY1YIVx7IkjkB+qYEkogK9NoBJ:QL6jvKVW3B1Yj3KvQJ

Score

N/A

Malware Config

Signatures

Files

fe32f3156fcab3713cc24f34e188e4698ece35e2a8b0eb7db086c74d0ce5851c
.dll windows x86

3d47b9ed8b08ccfce273522d91c60680

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FormatMessageA
GetCurrentProcessId
OpenProcess
GetProcessId
TerminateProcess
CloseHandle
LocalFree
GetSystemInfo
GetCurrentDirectoryA
GlobalMemoryStatusEx
VirtualQueryEx
Sleep
GetModuleFileNameA
GetModuleHandleA
QueryPerformanceFrequency
QueryPerformanceCounter
GetLocalTime
GetSystemTime
SystemTimeToFileTime
OutputDebugStringA
GetLastError
GetFileAttributesA
CreateDirectoryA
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
EnterCriticalSection
InterlockedExchange
LeaveCriticalSection
CreateSemaphoreA
OpenSemaphoreA
WaitForSingleObject
TerminateThread
LoadLibraryA
FreeLibrary
GetProcAddress
CreateProcessA
FindClose
FindNextFileA
FindFirstFileExA
FindFirstFileA
GetCurrentProcess
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent

ws2_32

send
recv
__WSAFDIsSet
select
listen
closesocket
WSAConnect
WSASocketA
WSACleanup
WSAStartup
bind
setsockopt
htons
htonl
accept

psapi

GetModuleBaseNameA
EnumProcessModules
EnumProcesses
GetProcessMemoryInfo

msvcp110

??Bid@locale@std@@QAEIXZ
?id@?$numpunct@D@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0facet@locale@std@@IAE@I@Z
??_7facet@locale@std@@6B@
??1facet@locale@std@@MAE@XZ
?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Gettrue@_Locinfo@std@@QBEPBDXZ
??0_Lockit@std@@QAE@H@Z
??0_Locinfo@std@@QAE@PBD@Z
??1_Lockit@std@@QAE@XZ
??1_Locinfo@std@@QAE@XZ
?_Incref@facet@locale@std@@UAEXXZ
?classic@locale@std@@SAABV12@XZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
??_7_Facet_base@std@@6B@
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z

msvcr110

_lock
_unlock
_calloc_crt
__dllonexit
_onexit
??1type_info@@UAE@XZ
__CppXcptFilter
_amsg_exit
_malloc_crt
_initterm
_initterm_e
_vsnprintf_s
_except_handler4_common
?terminate@@YAXXZ
__clean_type_info_names_internal
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
tolower
calloc
setvbuf
??0exception@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
_beginthreadex
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
_makepath_s
_splitpath_s
_fullpath
fflush
feof
fgets
ftell
fseek
_access
fread
fopen_s
strstr
strrchr
strchr
_strnicmp
strncpy_s
strcpy_s
strnlen
free
malloc
strcat_s
_splitpath
??_V@YAXPAX@Z
fclose
fwrite
fopen
??2@YAPAXI@Z
??3@YAXPAX@Z
_purecall
memmove
_strlwr
??8type_info@@QBE_NABV0@@Z
fputs
__iob_func
_CxxThrowException
__CxxFrameHandler3
memcpy
memset

Exports

Exports

MaestroGameController_AreProcessesHung
MaestroGameController_GetHeartbeatActive
MaestroGameController_Init
MaestroGameController_KillProcesses
MaestroGameController_Remove
MaestroGameController_SendChatMessage
MaestroGameController_SendGameAbandonedMessage
MaestroGameController_SendGameConnectedToServerMessage
MaestroGameController_SendGameLaunchedMessage
MaestroGameController_SendGameVersionMismatchMessage
MaestroGameController_SendShutdownMessage
MaestroGameController_SetExitCallback
MaestroGameController_SetHeartbeatActive
MaestroGameController_SetReceiveChatMessageCallback
MaestroGameController_Start
MaestroMessageAgent_Create
MaestroMessageAgent_Delete
MaestroMessageAgent_GetHeartbeatActive
MaestroMessageAgent_GetIsRunning
MaestroMessageAgent_SendMessage
MaestroMessageAgent_SetHeartbeatActive
MaestroMessageAgent_SetMessageArrivedCallback
MaestroMessageAgent_Start
MaestroProcessHelper_AllFilesExist
MaestroProcessHelper_GetProcessIDForProcessType
MaestroProcessHelper_GetProcessPathForProcessType
MaestroProcessHelper_Init
MaestroProcessHelper_IsProcessRunning
MaestroProcessHelper_KillProcess
MaestroProcessHelper_KillProcessByName
MaestroProcessHelper_Remove
MaestroProcessHelper_StartProcess
MaestroProcessHelper_StopProcess
MaestroServerController_CheckGameTerminationState
MaestroServerController_GetAirServerHandle
MaestroServerController_Init
MaestroServerController_ProcessEvents
MaestroServerController_RegisterHwnd
MaestroServerController_Remove
MaestroServerController_SetErrorMessageCallback
MaestroServerController_SetExitCallback
MaestroServerController_Start
MaestroServerController_StartArgs
MaestroServerController_StartArgsExplicit
MaestroServerController_Stop
MaestroServerController_VerifyAllNeededFilesExist
MaestroServer_Create
MaestroServer_Delete
MaestroServer_SendMessageToAllClients
MaestroServer_SetMessageArrivedCallback
MaestroServer_Start
Maestro_ErrorToString
Maestro_GetElapsedSeconds
Maestro_Init
Maestro_Log
Maestro_MessageTypeToString
Maestro_ProcessTypeToString
Maestro_Remove

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 90KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3d47b9ed8b08ccfce273522d91c60680

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ws2_32

psapi

msvcp110

msvcr110

Exports

Exports

Sections

.text Size: 80KB - Virtual size: 79KB

.rdata Size: 25KB - Virtual size: 24KB

.data Size: 2KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 12KB - Virtual size: 11KB

.text Size: 90KB - Virtual size: 92KB

.text
Size: 80KB - Virtual size: 79KB

.rdata
Size: 25KB - Virtual size: 24KB

.data
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 11KB

.text
Size: 90KB - Virtual size: 92KB