Mystify[.]scr | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Mystify.scr
Size

151KB
MD5

21a2d48b7c52402865119a4d8da73372
SHA1

b6d10b53c810c635165d1fa78cbc5c44774e81fb
SHA256

55203f7478d1d999e35d6f9e027b925b21a337bdef81c1c8ac2849d1bed5508a
SHA512

007b96f61307f5f54b1d955aebbb5b7d67ecc7853e9a196b920674af2eda64e736500d6efbb948c538514d2f02043ea368181106b4f3d7097f2d0d2eaf6264c9
SSDEEP

3072:yYx23CIx9fvN7AihnW/VB8eeuOGefIG0uVsC7Pq8SMj5L:C9NzhW/8dUtk5

Score

1^/10

Malware Config

Signatures

Files

Mystify.scr
.exe windows x64

312ed91925987430077fe1e3bb4adf2b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
EventActivityIdControl
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExA
RegQueryValueExA

kernel32

CreateSemaphoreExW
ReleaseSRWLockExclusive
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
InitOnceComplete
InitOnceBeginInitialize
GetTickCount
HeapSetInformation
OpenSemaphoreW
WaitForSingleObject
AcquireSRWLockExclusive
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
CloseHandle
SetLastError
OutputDebugStringW
IsDebuggerPresent
GetLastError
GetProcAddress
GetModuleHandleW
DebugBreak
GetModuleFileNameA
DeleteCriticalSection
InitializeCriticalSection
OutputDebugStringA
IsProcessorFeaturePresent
MulDiv
HeapAlloc
GetCurrentThreadId
GetModuleHandleExW
FormatMessageW
HeapFree

user32

OffsetRect
IntersectRect
LoadStringW
MessageBoxW
TranslateMessage
DrawTextW
SetRect
UpdateWindow
InvalidateRect
GetSystemMetrics
ScreenToClient
UnionRect
SetWindowPos
DefWindowProcW
EndPaint
FillRect
SystemParametersInfoA
BeginPaint
SetRectEmpty
SetCursor
KillTimer
SetTimer
PeekMessageW
SystemParametersInfoW
CreateWindowExW
PostMessageW
GetMessageW
AdjustWindowRect
GetClientRect
RegisterClassW
LoadIconW
LoadCursorW
EnumDisplaySettingsW
DispatchMessageW
PostQuitMessage

msvcrt

_lock
_commode
__dllonexit
_onexit
?terminate@@YAXXZ
_acmdln
__C_specific_handler
_initterm
__setusermatherr
_ismbblead
_cexit
_exit
_unlock
_fmode
exit
__set_app_type
rand
time
_vsnwprintf
memcpy_s
srand
__getmainargs
free
_XcptFilter
_amsg_exit
iswdigit
_atoi64
qsort
_finite
malloc
_callnewh
acosf
atan2f
cosf
memcpy
memset
sinf
sqrtf

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW
TerminateProcess
GetCurrentProcess

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetVersionExA

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-com-l1-1-0

CoUninitialize
CoInitializeEx

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-libraryloader-l1-2-0

LockResource
LoadResource
SizeofResource

comctl32

ord344
InitCommonControlsEx

d3d9

Direct3DCreate9

winmm

timeGetTime

gdi32

GetStockObject
GetDeviceCaps
CreateFontW
SelectObject
SetBkColor
SetTextColor
ExcludeClipRect
DeleteObject

Sections

.text
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 452B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

312ed91925987430077fe1e3bb4adf2b

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-libraryloader-l1-2-0

comctl32

d3d9

winmm

gdi32

Sections

.text Size: 87KB - Virtual size: 87KB

.rdata Size: 18KB - Virtual size: 17KB

.data Size: 1024B - Virtual size: 13KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 39KB - Virtual size: 39KB

.reloc Size: 512B - Virtual size: 452B

.text
Size: 87KB - Virtual size: 87KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 1024B - Virtual size: 13KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 39KB - Virtual size: 39KB

.reloc
Size: 512B - Virtual size: 452B