c1145b73e918aac2d513dc3f537c14905c7e5fde1535b3ce34744d9aff8a7a7f

Sharing

Copy URL Twitter E-mail

General

Target

c1145b73e918aac2d513dc3f537c14905c7e5fde1535b3ce34744d9aff8a7a7f
Size

4.7MB
MD5

7bda93ff15ad6d90a8bf922b08013702
SHA1

e64c1a063389e422084fc7efc545f4c378148f3d
SHA256

c1145b73e918aac2d513dc3f537c14905c7e5fde1535b3ce34744d9aff8a7a7f
SHA512

5ed26543460b41774b64aec14f69a81b4e7d87c29de87fb3acf617240bef3d77dd33f5011d3c7975a29af351ccc32499d7eb45804f6b59d16aaa79c554635a6f
SSDEEP

49152:KzxXAMxyez21NLNx0FISiqpCvDlcmXvlzzd+r0WuiTuifXStM87/jVI:KztWYvCrlz/l/d+17TuifcjV

Score

N/A

Malware Config

Signatures

Files

c1145b73e918aac2d513dc3f537c14905c7e5fde1535b3ce34744d9aff8a7a7f
.exe windows x86

845f4e2bf8487a8bc41766b4fcda0bcf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17
_TrackMouseEvent

d3d9

Direct3DCreate9

d3dx9_37

D3DXSphereBoundProbe
D3DXSaveTextureToFileInMemory
D3DXCreateTexture
D3DXCreateTextureFromFileInMemory
D3DXCreateTextureFromFileA
D3DXPlaneFromPointNormal
D3DXPlaneFromPoints
D3DXCreateFontA
D3DXCreateTextureFromFileExA
D3DXCreateTextureFromFileInMemoryEx
D3DXMatrixReflect
D3DXMatrixPerspectiveFovLH
D3DXMatrixLookAtLH
D3DXVec3TransformCoord
D3DXMatrixScaling
D3DXMatrixInverse
D3DXIntersectTri
D3DXCreateEffectFromFileA
D3DXGetShaderOutputSemantics
D3DXVec2Normalize
D3DXMatrixOrthoLH
D3DXMatrixRotationAxis
D3DXVec3Normalize
D3DXSaveSurfaceToFileA
D3DXMatrixMultiply

dinput8

DirectInput8Create

zlibwapi

ord26
ord63
ord100
ord66
ord79
ord64
ord101
ord65
ord61
ord84
ord68
ord72
ord80
ord62

fmodex

?getVersion@System@FMOD@@QAG?AW4FMOD_RESULT@@PAI@Z
?getCPUUsage@System@FMOD@@QAG?AW4FMOD_RESULT@@PAM000@Z
?createSound@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAUFMOD_CREATESOUNDEXINFO@@PAPAVSound@2@@Z
?createStream@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAUFMOD_CREATESOUNDEXINFO@@PAPAVSound@2@@Z
?playSound@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_CHANNELINDEX@@PAVSound@2@_NPAPAVChannel@2@@Z
?release@Sound@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?set3DMinMaxDistance@Sound@FMOD@@QAG?AW4FMOD_RESULT@@MM@Z
FMOD_System_Create
?set3DListenerAttributes@System@FMOD@@QAG?AW4FMOD_RESULT@@HPBUFMOD_VECTOR@@000@Z
?set3DSettings@System@FMOD@@QAG?AW4FMOD_RESULT@@MMM@Z
?update@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?close@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?init@System@FMOD@@QAG?AW4FMOD_RESULT@@HIPAX@Z
?release@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?isPlaying@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?set3DAttributes@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_VECTOR@@0@Z
?getVolume@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAM@Z
?setPaused@Channel@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?stop@Channel@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?setVolume@Channel@FMOD@@QAG?AW4FMOD_RESULT@@M@Z

kernel32

GetTimeZoneInformation
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
FlushFileBuffers
GetConsoleMode
GetConsoleCP
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetFileType
SetHandleCount
SetFilePointer
GetStdHandle
WriteFile
HeapSize
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
RaiseException
RtlUnwind
GetDateFormatA
GetTimeFormatA
DuplicateHandle
MoveFileA
ExitProcess
CreateProcessA
CopyFileA
WritePrivateProfileStringA
CloseHandle
DeleteFileA
GetPrivateProfileIntA
Sleep
OutputDebugStringA
DeleteCriticalSection
InitializeCriticalSection
lstrcatA
lstrcpyA
GetModuleHandleA
FindClose
CreateDirectoryA
FindFirstFileA
GetModuleFileNameA
QueryPerformanceFrequency
QueryPerformanceCounter
EnterCriticalSection
FindNextFileA
GetLastError
CreateThread
LeaveCriticalSection
GetTickCount
FileTimeToSystemTime
FileTimeToLocalFileTime
MultiByteToWideChar
CreatePipe
TerminateThread
LCMapStringA
SetThreadPriority
WideCharToMultiByte
GetFullPathNameA
CreateFileA
GlobalAlloc
GetFileAttributesA
SetFileAttributesA
GetCurrentDirectoryA
GetWindowsDirectoryA
SetPriorityClass
GetCurrentProcess
GetPrivateProfileStringA
WinExec
HeapFree
HeapAlloc
ReadFile
GetProcessHeap
GetProcessWorkingSetSize
GetSystemInfo
GlobalMemoryStatus
lstrcpynA
SetLastError
GetProcAddress
FreeLibrary
LoadLibraryA
OutputDebugStringW
GlobalLock
GlobalUnlock
FormatMessageA
InterlockedIncrement
GetQueuedCompletionStatus
InterlockedDecrement
PostQueuedCompletionStatus
CreateIoCompletionPort
GetStartupInfoA
GetVersionExA
GetCommandLineA
HeapReAlloc
ResumeThread
ExitThread
GetSystemTimeAsFileTime
SetCurrentDirectoryA
SetEnvironmentVariableA
GetDriveTypeA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetExitCodeProcess
LCMapStringW
CreateFileW
SetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
GetCurrentThreadId
InterlockedExchange
WaitForSingleObject
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW
SetEnvironmentVariableW
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetLocalTime

user32

GetDC
SetCursor
ShowCursor
PtInRect
ClientToScreen
CharLowerA
LoadCursorFromFileA
GetClipboardData
SetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
BeginPaint
ReleaseCapture
UpdateWindow
SetForegroundWindow
PostMessageA
InvalidateRect
wvsprintfA
FindWindowA
SetRect
CreateWindowExA
GetAsyncKeyState
SendMessageA
GetDlgItem
SetWindowLongA
ReleaseDC
EndDialog
LoadCursorA
DefWindowProcA
ClipCursor
GetSystemMetrics
GetActiveWindow
SetFocus
GetMessageA
EndPaint
DestroyMenu
GetMenu
DestroyWindow
AdjustWindowRect
GetCursorPos
PostQuitMessage
DispatchMessageA
GetWindowRect
ScreenToClient
GetClassLongA
LoadIconA
PostThreadMessageA
CreateDialogParamA
GetWindowTextA
GetClientRect
SetWindowPos
RegisterClassA
GetDesktopWindow
GetWindowLongA
ShowWindow
SetWindowTextA
MessageBoxA
TranslateMessage
SetCapture
PeekMessageA

gdi32

SetBkColor
TextOutA
AddFontResourceA
CreateScalableFontResourceA
SetBkMode
CreateDIBitmap
SetTextColor
GetStockObject
DeleteObject

advapi32

RegCreateKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA

shell32

ShellExecuteA

ole32

CLSIDFromString
CoCreateGuid

wsock32

htons
getsockopt
socket
ioctlsocket
accept
listen
getpeername
inet_ntoa
bind
recv
gethostbyname
setsockopt
connect
gethostbyaddr
closesocket
send
WSAGetLastError
WSACleanup
WSAStartup
gethostname
select

ws2_32

WSARecv
WSASend

winmm

timeGetTime

shlwapi

wvnsprintfA

imm32

ImmGetContext
ImmReleaseContext
ImmAssociateContext
ImmSetStatusWindowPos

rpcrt4

RpcStringFreeA
UuidToStringA

usp10

ScriptStringFree
ScriptApplyDigitSubstitution
ScriptStringXtoCP
ScriptStringCPtoX
ScriptStringAnalyse

Exports

Exports

class_gc_event
tolua_array
tolua_beginmodule
tolua_cclass
tolua_classevents
tolua_constant
tolua_copy
tolua_default_collect
tolua_dobuffer
tolua_endmodule
tolua_error
tolua_fast_isa
tolua_function
tolua_getfieldboolean
tolua_isboolean
tolua_isbooleanarray
tolua_ismodulemetatable
tolua_isnoobj
tolua_isnumber
tolua_isnumberarray
tolua_isstring
tolua_isstringarray
tolua_istable
tolua_istablearray
tolua_isuserdata
tolua_isuserdataarray
tolua_isusertable
tolua_isusertype
tolua_isusertypearray
tolua_isvalue
tolua_isvaluearray
tolua_module
tolua_moduleevents
tolua_open
tolua_pushboolean
tolua_pushfieldboolean
tolua_pushfieldnumber
tolua_pushfieldstring
tolua_pushfielduserdata
tolua_pushfieldusertype
tolua_pushfieldusertype_and_takeownership
tolua_pushfieldvalue
tolua_pushnumber
tolua_pushstring
tolua_pushuserdata
tolua_pushusertype
tolua_pushusertype_and_takeownership
tolua_pushvalue
tolua_register_gc
tolua_toboolean
tolua_tofieldnumber
tolua_tofieldstring
tolua_tofielduserdata
tolua_tofieldusertype
tolua_tofieldvalue
tolua_tonumber
tolua_tostring
tolua_touserdata
tolua_tousertype
tolua_tovalue
tolua_typename
tolua_usertype
tolua_variable

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 853KB - Virtual size: 853KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 257KB - Virtual size: 101.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 517KB - Virtual size: 516KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

845f4e2bf8487a8bc41766b4fcda0bcf

Headers

File Characteristics

Imports

comctl32

d3d9

d3dx9_37

dinput8

zlibwapi

fmodex

kernel32

user32

gdi32

advapi32

shell32

ole32

wsock32

ws2_32

winmm

shlwapi

imm32

rpcrt4

usp10

Exports

Exports

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

.rdata Size: 853KB - Virtual size: 853KB

.data Size: 257KB - Virtual size: 101.8MB

.rsrc Size: 14KB - Virtual size: 13KB

.reloc Size: 517KB - Virtual size: 516KB

.text
Size: 3.1MB - Virtual size: 3.1MB

.rdata
Size: 853KB - Virtual size: 853KB

.data
Size: 257KB - Virtual size: 101.8MB

.rsrc
Size: 14KB - Virtual size: 13KB

.reloc
Size: 517KB - Virtual size: 516KB