Static task
static1
General
-
Target
eosd.exe
-
Size
500KB
-
MD5
fa3d64768b1bfc50703dedc2db92f7fa
-
SHA1
e61b4f4fea3802e926ef307f45166599c3e86555
-
SHA256
9f76483c46256804792399296619c1274363c31cd8f1775fafb55106fb852245
-
SHA512
619157f0dd14d377193231fc1969ca949adb2ca502a365f641bf06fe15286c4cf4e744756541f25b7c7c514cffd0db23f667375d61d6f6b3bd41827c7b15f614
-
SSDEEP
12288:moxc9FbINZpDX+FiuWysbiwjjVCCnzSEVhARNtTP2Fc:moOU7+iuvmiw0CnzSnAF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eosd.exe
Files
-
eosd.exe.exe windows x86
17b55a57ba1d7e45de0a854174eb9c8f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
dinput8
DirectInput8Create
dsound
ord11
d3d8
Direct3DCreate8
winmm
mmioSeek
mmioGetInfo
mmioSetInfo
mmioDescend
mmioRead
mmioAscend
mmioOpenA
mmioClose
midiOutUnprepareHeader
timeKillEvent
timeSetEvent
timeGetDevCaps
midiOutShortMsg
midiOutPrepareHeader
midiOutLongMsg
midiOutReset
midiOutClose
midiOutOpen
timeBeginPeriod
timeGetTime
timeEndPeriod
joyGetPosEx
joyGetDevCapsA
midiOutGetNumDevs
mmioAdvance
kernel32
GetOEMCP
GetACP
GetLocaleInfoA
GetCPInfo
GetStringTypeW
GetStringTypeA
InitializeCriticalSection
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcAddress
LoadLibraryA
GetLastError
CreateMutexA
CreateThread
CreateEventA
CloseHandle
WaitForSingleObject
FindClose
FindNextFileA
FindFirstFileA
Sleep
GetFileSize
GetFileTime
SetFilePointer
IsBadReadPtr
DeleteFileA
ReadFile
WriteFile
LocalFree
LocalAlloc
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
HeapFree
GetModuleHandleA
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetFileType
GetStdHandle
SetHandleCount
TlsAlloc
TlsGetValue
TlsSetValue
SetLastError
TlsFree
IsBadWritePtr
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
VirtualFree
HeapCreate
HeapDestroy
GetModuleFileNameA
GetSystemTimeAsFileTime
IsBadCodePtr
SetStdHandle
FlushFileBuffers
LCMapStringA
LCMapStringW
VirtualProtect
GetSystemInfo
VirtualQuery
SetEndOfFile
CreateFileA
ExitProcess
HeapAlloc
RtlUnwind
RaiseException
GetLocalTime
CreateDirectoryA
SetEnvironmentVariableA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetStartupInfoA
GetCommandLineA
TerminateProcess
GetCurrentProcess
HeapReAlloc
HeapSize
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
user32
DrawTextW
MsgWaitForMultipleObjects
PostThreadMessageA
KillTimer
SetTimer
SetCursor
DefWindowProcA
LoadCursorA
RegisterClassA
CreateWindowExA
GetSystemMetrics
SystemParametersInfoA
ShowCursor
PeekMessageA
TranslateMessage
DispatchMessageA
ShowWindow
MoveWindow
DestroyWindow
DrawTextA
MessageBoxA
SetKeyboardState
GetKeyboardState
GetWindowLongA
gdi32
SetBkColor
CreateFontIndirectA
GetObjectA
GetStockObject
TextOutA
SetBkMode
SetTextColor
CreateDIBSection
DeleteDC
CreateCompatibleDC
CreateFontA
SelectObject
DeleteObject
Sections
.text Size: 420KB - Virtual size: 418KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 48KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ