Static task
static1
Behavioral task
behavioral1
Sample
DLL_UNLOAD.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
DLL_UNLOAD.exe
Resource
win10v2004-20230220-en
General
-
Target
MXT_1.1.0_FIXED.rar
-
Size
1.8MB
-
MD5
e6a32634cb4e4b3d5e0ab15f5344a0b4
-
SHA1
39753def72762c9659c7823351210a6c6e612b1e
-
SHA256
869c6d5da063d91efef2dc6441933191850415609aa295309b48e4dae0906a62
-
SHA512
d4ea90502342bb63cf8758b9632a5f53b8d61953c837abb5971dd675fb00c51b0fc1fa6ba98ce0140af7c6b345c61dd4d51a99973e506732cfef05b9f284a7d7
-
SSDEEP
24576:0QH6DwmNwGJ3lbMggY9eb1aj3NAUL16KqAQ7VOmv+qWdOruQ/LBQOJqTNy5NdYn:0QSw41bM9Wd7EKi/voOb/10JQYn
Malware Config
Signatures
Files
-
MXT_1.1.0_FIXED.rar.rar
-
DLL_UNLOAD.exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Dx11 ImGui - Black Ops lll.dll.dll windows x64
7ff9f777b191513395bbc28eaa66ccff
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateToolhelp32Snapshot
GetCurrentThread
CloseHandle
GetThreadContext
GetCurrentProcessId
SetThreadContext
OpenThread
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
LoadLibraryA
QueryPerformanceFrequency
FreeLibrary
QueryPerformanceCounter
GetTickCount
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
HeapFree
GetCurrentProcess
HeapReAlloc
HeapAlloc
HeapDestroy
FlushInstructionCache
K32GetModuleInformation
GetTickCount64
InitializeSListHead
GetSystemTimeAsFileTime
IsDebuggerPresent
SuspendThread
ExitThread
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetLocaleInfoEx
FormatMessageA
LocalFree
GetFileInformationByHandleEx
GetLastError
AreFileApisANSI
GetCurrentThreadId
Thread32First
Thread32Next
GetModuleFileNameW
VirtualProtect
GetModuleHandleW
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
ResumeThread
GetProcAddress
RtlCaptureStackBackTrace
CreateThread
IsProcessorFeaturePresent
Sleep
GetFileAttributesExW
TerminateProcess
GetModuleHandleA
user32
SetWindowLongPtrW
CreateWindowExW
UnregisterClassW
DestroyWindow
GetAsyncKeyState
CallWindowProcW
DefWindowProcW
SendMessageA
FindWindowW
FindWindowExW
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
ReleaseCapture
GetClientRect
SetCursor
SetCapture
LoadCursorW
GetForegroundWindow
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
GetKeyState
RegisterClassExW
shell32
SHGetSpecialFolderPathA
ShellExecuteW
msvcp140
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
_Strxfrm
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
_Xtime_get_ticks
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
d3dcompiler_47
D3DCompile
d3d11
D3D11CreateDeviceAndSwapChain
urlmon
URLOpenBlockingStreamW
imm32
ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
ImmAssociateContextEx
ImmSetCandidateWindow
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
_CxxThrowException
__C_specific_handler
__current_exception_context
__current_exception
strchr
strstr
__std_type_info_destroy_list
memchr
memcmp
memcpy
memmove
__std_exception_destroy
__std_exception_copy
__std_terminate
api-ms-win-crt-heap-l1-1-0
_callnewh
realloc
malloc
free
api-ms-win-crt-stdio-l1-1-0
fgetpos
__stdio_common_vsprintf
fopen_s
fwrite
_wfopen
ungetc
feof
fgetc
fseek
fsetpos
fclose
fflush
ferror
fread
fputc
ftell
_fseeki64
_get_stream_buffer_pointers
setvbuf
__stdio_common_vsprintf_s
__stdio_common_vsnprintf_s
__stdio_common_vsscanf
__acrt_iob_func
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_initialize_narrow_environment
terminate
_cexit
_errno
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_execute_onexit_table
_crt_atexit
_configure_narrow_argv
_initterm_e
_initterm
api-ms-win-crt-convert-l1-1-0
_atoi64
strtol
atof
strtof
atoi
strtoul
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-string-l1-1-0
isspace
strncmp
toupper
strtok
strcat_s
strncpy
strncpy_s
isalnum
isblank
strcmp
api-ms-win-crt-math-l1-1-0
cosf
atan2f
floorf
ceilf
sqrtf
atan2
sinf
acosf
ldexp
powf
fmodf
api-ms-win-crt-utility-l1-1-0
rand
qsort
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
Sections
.text Size: 704KB - Virtual size: 703KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 45.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
MXT Backgrounds/mxt_bg_image_0.png.jpg
-
MXT Backgrounds/mxt_bg_image_1.png.jpg
-
MXT Backgrounds/mxt_bg_image_2.png.png
-
MXT Backgrounds/mxt_bg_image_3.png.jpg
-
MXT Backgrounds/mxt_bg_image_4.png.jpg
-
mxt_data_table.txt
-
mxt_load_styles.txt
-
mxt_lua_editor.lua
-
mxt_stat_editor.txt
-
mxt_visual_presets.txt