gmsv_penguins_win64[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

gmsv_penguins_win64.dll
Size

3.1MB
MD5

c9c4d28edeee4e9d3a76f8ab0a9fbe16
SHA1

88049e775216a0a5fec750820b35fd1a9100e476
SHA256

493a362fabd921ee6b6c2a57761f775bae29acd84878a6da44720a5909095e54
SHA512

e14b4715df09ad78626ce277cc12073d9c45e4d6a924dcec20ef3082717ff0e9ffd3429b6e6966a9024ff6eb1305a91bb7b8a6cf5ca1ff63413aa53e58e352b4
SSDEEP

49152:S40yW6u/tMdZ+tYACQrcpSYZ2OoixfU3cyh3rV/udYr2bGLsnvc+H9S38:+/kJOHYQOpyh7V/6RcRM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
gmsv_penguins_win64.dll

Files

gmsv_penguins_win64.dll
.dll windows x64

b63c6875c4af4587419722de9171b70a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

tier0

g_pMemAlloc
Warning

vstdlib

RandomInt

kernel32

GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
QueryPerformanceCounter
SetEndOfFile
GetTimeZoneInformation
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetConsoleOutputCP
WriteFile
ReadConsoleW
GetConsoleMode
GetModuleFileNameW
QueryPerformanceFrequency
GetLogicalDriveStringsA
GetLastError
FindClose
FindNextFileW
GetFullPathNameW
FindFirstFileExW
CreateDirectoryW
VirtualQuery
AllocConsole
GetConsoleWindow
FreeLibrary
GetProcAddress
CreateThread
K32GetModuleInformation
FreeConsole
LoadLibraryA
GetCurrentThread
GetModuleHandleA
GetStdHandle
GetCurrentProcess
SetConsoleTitleA
SetEnvironmentVariableW
SetFilePointerEx
SetStdHandle
SetConsoleTextAttribute
VirtualProtect
GetModuleFileNameA
DeleteFileW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
FreeLibraryAndExitThread
ExitThread
GetModuleHandleExW
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
RaiseException
RtlPcToFileHeader
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwindEx
GetStringTypeW
GetCPInfo
CompareStringEx
LCMapStringEx
DecodePointer
EncodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetExitCodeThread
TryAcquireSRWLockExclusive
InitializeSRWLock
GetLocaleInfoEx
FormatMessageA
LocalFree
GetCurrentThreadId
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualFree
SetLastError
GetModuleHandleW
LoadLibraryExW
WriteConsoleW
CreateFileA
GetFileSizeEx
ReadFile
CloseHandle
HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
RtlVirtualUnwind
GetEnvironmentVariableW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetSystemDirectoryW
LoadLibraryW
Sleep
FormatMessageW
MoveFileExW
WaitForSingleObjectEx
GetEnvironmentVariableA
GetCurrentProcessId
GetFileType
PeekNamedPipe
WaitForMultipleObjects
SleepEx
VerSetConditionMask
VerifyVersionInfoW
CreateFileW
GetModuleHandleExA
HeapCreate
Thread32Next
Thread32First
CreateToolhelp32Snapshot
HeapDestroy
OpenThread
GetSystemInfo
K32EnumProcessModules
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetSystemTimeAsFileTime
GetCurrentDirectoryW
FindFirstFileW
GetFileAttributesExW
GetFileInformationByHandle
SetFileInformationByHandle
AreFileApisANSI
GetFileInformationByHandleEx

user32

GetKeyState
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
RegisterClassExA
UnregisterClassA
CreateWindowExA
DefWindowProcA
DestroyWindow
GetCapture
ClientToScreen
IsChild
GetForegroundWindow
SetCapture
SetCursor
GetClientRect
ReleaseCapture
GetSystemMenu
LoadCursorA
PostMessageA
GetKeyNameTextA
GetAsyncKeyState
GetCursorInfo
CallWindowProcA
MapVirtualKeyA
MessageBoxA
EnableMenuItem
SetWindowLongPtrA
GetCursorPos
SetCursorPos
ScreenToClient

advapi32

CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegEnumValueA
RegOpenKeyExA
RegQueryInfoKeyA
RegCloseKey
CryptHashData

crypt32

CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
CryptQueryObject
CryptStringToBinaryW
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertGetNameStringW
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
PFXImportCertStore

xinput1_4

ord4
ord2

imm32

ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow

bcrypt

BCryptGenRandom

ws2_32

WSACloseEvent
WSAEnumNetworkEvents
getsockopt
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
closesocket
WSAGetLastError
ntohs
WSASetLastError
gethostname
inet_ntop
WSAStartup
WSACleanup
setsockopt
WSAIoctl
htons
socket
inet_pton
__WSAFDIsSet
select
accept
bind
connect
WSACreateEvent
getsockname
htonl
listen
recv
getaddrinfo
freeaddrinfo
recvfrom
sendto
getpeername
ioctlsocket
send

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 792KB - Virtual size: 792KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b63c6875c4af4587419722de9171b70a

Headers

DLL Characteristics

File Characteristics

Imports

tier0

vstdlib

kernel32

user32

advapi32

crypt32

xinput1_4

imm32

bcrypt

ws2_32

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 792KB - Virtual size: 792KB

.data Size: 40KB - Virtual size: 70KB

.pdata Size: 102KB - Virtual size: 101KB

.detourc Size: 8KB - Virtual size: 8KB

.detourd Size: 512B - Virtual size: 24B

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 792KB - Virtual size: 792KB

.data
Size: 40KB - Virtual size: 70KB

.pdata
Size: 102KB - Virtual size: 101KB

.detourc
Size: 8KB - Virtual size: 8KB

.detourd
Size: 512B - Virtual size: 24B

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 12KB - Virtual size: 11KB