0d80176a265806758e42afa74dad659232bd19bc3130bcfe79ea275288126e32

Sharing

Copy URL

Twitter E-mail

General

Target

0d80176a265806758e42afa74dad659232bd19bc3130bcfe79ea275288126e32
Size

1.8MB
MD5

94e5232bdbc0936ad28cdec897dec74d
SHA1

438ced659cb9a8cae6e69f83488e39b9087eeba1
SHA256

0d80176a265806758e42afa74dad659232bd19bc3130bcfe79ea275288126e32
SHA512

aa51137f188d1c2b7cb88e3bd3fefa90e98272b4967c4c6ff4d7eb39823515652bfb3c28a67306acd6ca4499ccbedd7689a29c834c3913084d077151b1932f0b
SSDEEP

49152:ICPu3EyMVxDobbDbMR86rx35EdmxkE6ntVB7:ICPu3rzwR3LI3

Score

1^/10

Malware Config

Signatures

Files

0d80176a265806758e42afa74dad659232bd19bc3130bcfe79ea275288126e32
.exe windows x64

7da8828a6838a89c3351e470fa23d66a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
ResetEvent
CreateFileA
WaitForMultipleObjects
PeekNamedPipe
ReadFile
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapSize
OutputDebugStringW
SetEvent
GetFileSizeEx
InitializeCriticalSectionAndSpinCount
GetTickCount
GetConsoleWindow
Beep
Sleep
QueryPerformanceCounter
FreeLibrary
VerSetConditionMask
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
HeapFree
InitializeCriticalSectionEx
DeleteCriticalSection
GetCurrentProcess
CreateThread
VirtualProtect
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameA
GetProcessHeap
GetModuleFileNameW
GetModuleHandleW
SetLastError
FormatMessageA
LocalFree
EnterCriticalSection
LeaveCriticalSection
SleepEx
GetSystemDirectoryA
VerifyVersionInfoA
MoveFileExA
WaitForSingleObjectEx
MultiByteToWideChar
CloseHandle
CreateFileW
TerminateProcess
GetEnvironmentVariableA
GetStdHandle
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
GetFileType

user32

GetClientRect
SetCursor
SetCapture
GetForegroundWindow
TrackMouseEvent
SetCursorPos
IsWindowUnicode
OpenClipboard
CloseClipboard
MessageBoxA
DispatchMessageA
GetWindowRect
EmptyClipboard
GetClipboardData
GetCursorPos
DestroyWindow
CreateWindowExW
GetSystemMetrics
UnregisterClassW
RegisterClassExW
ShowWindow
GetAsyncKeyState
MoveWindow
DefWindowProcA
SetClipboardData
ReleaseCapture
LoadCursorA
GetKeyState
ClientToScreen
UpdateWindow
PostQuitMessage
PeekMessageA
LoadIconA
TranslateMessage
ScreenToClient
GetCapture

imm32

ImmSetCompositionWindow
ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xbad_function_call@std@@YAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z

dwmapi

DwmExtendFrameIntoClientArea

ntdll

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

normaliz

IdnToAscii

wldap32

ord143
ord217
ord46
ord211
ord60
ord45
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301

crypt32

CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
PFXImportCertStore
CertGetNameStringA
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertFreeCertificateContext
CryptStringToBinaryA
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore

ws2_32

connect
closesocket
setsockopt
recv
send
WSAGetLastError
socket
ntohl
gethostname
sendto
bind
recvfrom
WSASetLastError
htons
WSAIoctl
freeaddrinfo
getaddrinfo
select
ntohs
getpeername
__WSAFDIsSet
ioctlsocket
getsockname
listen
getsockopt
htonl
accept
WSACleanup
WSAStartup

rpcrt4

UuidToStringA
RpcStringFreeA
UuidCreate

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strrchr
__current_exception
__current_exception_context
__C_specific_handler
memset
_CxxThrowException
__std_exception_copy
__std_exception_destroy
strchr
strstr
__std_terminate
memcpy
memmove
memchr
memcmp

api-ms-win-crt-stdio-l1-1-0

_wfopen
fwrite
__stdio_common_vfprintf
_lseeki64
__stdio_common_vsprintf
fread
__stdio_common_vsscanf
_set_fmode
feof
fputs
fopen
fclose
fflush
__acrt_iob_func
_open
_close
_popen
_pclose
fgets
_write
_read
ftell
__p__commode
fseek
fputc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

isupper
_strdup
strncpy
strspn
strcspn
tolower
strncmp
strpbrk
strcmp

api-ms-win-crt-heap-l1-1-0

free
calloc
_set_new_mode
realloc
malloc
_callnewh

api-ms-win-crt-convert-l1-1-0

strtod
strtoul
atoi
strtoll
strtol
strtoull

api-ms-win-crt-runtime-l1-1-0

terminate
_c_exit
__p___argv
_errno
abort
strerror
__sys_nerr
_invalid_parameter_noinfo
_resetstkoflw
exit
__p___argc
_invalid_parameter_noinfo_noreturn
_getpid
_exit
_initterm_e
_register_thread_local_exe_atexit_callback
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_beginthreadex

api-ms-win-crt-time-l1-1-0

_localtime64
_difftime64
_mktime64
_gmtime64
_time64

api-ms-win-crt-filesystem-l1-1-0

_fstat64
_access
_unlink
_stat64

api-ms-win-crt-locale-l1-1-0

localeconv
_configthreadlocale

api-ms-win-crt-math-l1-1-0

sinf
sin
__setusermatherr
fmodf
cosf
ceilf
acosf
sqrtf
_dclass
cos

advapi32

CryptReleaseContext
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptAcquireContextA
ConvertSidToStringSidA
CryptDestroyHash
IsValidSid
GetTokenInformation
GetLengthSid
CopySid
CryptGetHashParam
OpenProcessToken
CryptGenRandom
CryptCreateHash
CryptHashData

shell32

ShellExecuteA

Sections

.text
Size: 644KB - Virtual size: 644KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 952KB - Virtual size: 951KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 212KB - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7da8828a6838a89c3351e470fa23d66a

Headers

DLL Characteristics

File Characteristics

Imports

d3dx11_43

d3d11

d3dcompiler_43

kernel32

user32

imm32

msvcp140

dwmapi

ntdll

normaliz

wldap32

crypt32

ws2_32

rpcrt4

psapi

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

advapi32

shell32

Sections

.text Size: 644KB - Virtual size: 644KB

.rdata Size: 952KB - Virtual size: 951KB

.data Size: 212KB - Virtual size: 228KB

.pdata Size: 26KB - Virtual size: 26KB

.rsrc Size: 12KB - Virtual size: 11KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 644KB - Virtual size: 644KB

.rdata
Size: 952KB - Virtual size: 951KB

.data
Size: 212KB - Virtual size: 228KB

.pdata
Size: 26KB - Virtual size: 26KB

.rsrc
Size: 12KB - Virtual size: 11KB

.reloc
Size: 2KB - Virtual size: 1KB