H264BSAnalyzer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

H264BSAnalyzer.exe
Size

5.4MB
MD5

ec6b0182dd361cd3ed7d3aed8da9e185
SHA1

25a5ef611b5b6e993a22c5bee4842f2da3237156
SHA256

d172e5069d0101e8c77d1c3e50473dc4db41d73952f957015c8daa9ab5541d62
SHA512

7dda8be868a7f5d2efb6bc0331cfbccc3ae525d4ad06a68c6ceb2a581e141357f6683622de617506a0f2ea5ee95a9505c128a5f288c157eab1340ff3bfc566c9
SSDEEP

98304:JtDPHxvv6Ev7NuWBTNLwOmE5+6Okj9qorbor5aHGBAUZLqcL83m:3HxaEz/Dp5+6Okj9qorbor5aHGVGc5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
H264BSAnalyzer.exe

Files

H264BSAnalyzer.exe
.exe windows x86

23ae653dae2394a7404432ff4da197bb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mfc100

ord4933
ord11107
ord2752
ord310
ord7933
ord6970
ord11882
ord5627
ord1313
ord3621
ord5539
ord978
ord422
ord7871
ord5175
ord4785
ord12868
ord13219
ord12440
ord10030
ord1210
ord788
ord3390
ord7206
ord7889
ord7581
ord4344
ord9475
ord6680
ord3254
ord3839
ord1929
ord1900
ord6106
ord5437
ord8235
ord895
ord5858
ord9286
ord5302
ord5123
ord11103
ord2846
ord2944
ord977
ord3484
ord11060
ord2338
ord5253
ord12482
ord10672
ord6128
ord13300
ord7074
ord13302
ord2661
ord3984
ord13980
ord3991
ord4401
ord4368
ord4364
ord4398
ord4419
ord4377
ord4406
ord4415
ord4385
ord4389
ord4393
ord4381
ord4410
ord4373
ord1514
ord1507
ord1509
ord1503
ord1496
ord421
ord12865
ord4130
ord3970
ord915
ord5777
ord8222
ord2742
ord3738
ord6316
ord265
ord7216
ord4993
ord7297
ord300
ord2195
ord11431
ord740
ord12189
ord2270
ord741
ord4345
ord12344
ord10357
ord12124
ord12790
ord5774
ord4340
ord2183
ord943
ord374
ord6836
ord1985
ord2184
ord5830
ord11188
ord11190
ord12644
ord2847
ord8351
ord9994
ord6217
ord11154
ord8070
ord13294
ord10883
ord968
ord5821
ord5444
ord4499
ord3395
ord11025
ord8228
ord13973
ord11067
ord8137
ord10007
ord10360
ord2974
ord2973
ord5532
ord12531
ord2416
ord11108
ord8330
ord8305
ord5805
ord12962
ord2945
ord13972
ord14045
ord14062
ord14058
ord14060
ord14061
ord14059
ord2417
ord7349
ord2878
ord2881
ord12535
ord5534
ord3744
ord385
ord7584
ord7510
ord11726
ord13767
ord4724
ord2163
ord11420
ord11421
ord13301
ord7073
ord13299
ord8486
ord3676
ord3618
ord11806
ord7091
ord1732
ord14075
ord10922
ord13181
ord11413
ord7144
ord13483
ord13480
ord13485
ord13482
ord13484
ord13481
ord3409
ord5238
ord11172
ord11180
ord7355
ord9449
ord11184
ord11153
ord11787
ord4622
ord4903
ord5095
ord8439
ord4881
ord5098
ord4625
ord4774
ord4606
ord6897
ord6898
ord6888
ord4772
ord7357
ord9281
ord8304
ord6112
ord2088
ord4078
ord948
ord5776
ord5837
ord3439
ord316
ord4283
ord1982
ord946
ord1280
ord901
ord1012
ord3620
ord12672
ord849
ord1890
ord7141
ord1288
ord888
ord6835
ord9399
ord1294
ord2617
ord1296

msvcr100

_wsopen
_sopen
sin
cos
atan
strtod
strtoul
strftime
floor
log
getenv
fputs
sqrt
bsearch
strcpy
strrchr
_lseeki64
sscanf
strcspn
strtol
strspn
atoi
strchr
strcmp
_errno
abort
ceil
pow
exp
_iob
tan
asin
__CxxFrameHandler3
acos
fabs
sinh
cosh
tanh
clock
longjmp
toupper
_snprintf_s
_setjmp3
memset
memcpy
_setmbcp
_fstat32i64
_localtime32
_time32
_gmtime32
_mktime32
_close
_access
_write
_read
_isatty
_fdopen
_putenv
__mb_cur_max
_pctype
_isctype
fputc
localeconv
_get_output_format
wcslen
setlocale
memcmp
qsort
strlen
atan2
_controlfp_s
_invoke_watson
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_onexit
_lock
__dllonexit
_unlock
memchr
_splitpath
fgetc
feof
isprint
sprintf
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABV01@@Z
memmove
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
__iob_func
fprintf
calloc
realloc
vsprintf
strncmp
fwrite
fclose
free
malloc
fseek
fread
printf
fopen
_CxxThrowException

kernel32

InterlockedCompareExchange
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDBCSLeadByteEx
InitializeCriticalSection
EnterCriticalSection
DeleteCriticalSection
IsProcessorFeaturePresent
InterlockedExchange
VirtualFree
MultiByteToWideChar
GetProcessAffinityMask
GetConsoleScreenBufferInfo
GetStdHandle
SetConsoleTextAttribute
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
DecodePointer
EncodePointer
Sleep
GlobalSize
GlobalUnlock
GlobalLock
GlobalAlloc
WaitForSingleObject
SetEvent
CreateThread
VirtualAlloc
WideCharToMultiByte
LeaveCriticalSection
GetACP
CreateEventA

user32

IsIconic
GetSystemMetrics
DrawIcon
GetClientRect
LoadCursorA
SetCursor
InvalidateRect
SendMessageA
AppendMenuA
GetSystemMenu
LoadIconW
GetWindowRect
DrawTextA
SetTimer
KillTimer
GetDC
LoadBitmapA
RegisterClipboardFormatA
EmptyClipboard
GetKeyState
ReleaseCapture
EnableScrollBar
SetScrollInfo
PtInRect
CreateCaret
SetCapture
DragDetect
SetScrollPos
DestroyCaret
ShowCaret
SetCaretPos
GetSysColor
FillRect
EnableWindow

gdi32

BitBlt
TextOutA
GetTextExtentPoint32A
GetCharWidthA
SetBoundsRect
CreateSolidBrush
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontA

shell32

ShellExecuteA
DragQueryFileA
DragFinish

comctl32

InitCommonControlsEx

ole32

CreateStreamOnHGlobal

gdiplus

GdiplusShutdown
GdipCreateFromHWND
GdipDeleteGraphics
GdipDrawImageRectI
GdipCreateBitmapFromStream
GdipFree
GdipAlloc
GdipCloneImage
GdipDisposeImage
GdiplusStartup

msvcp100

?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z

advapi32

CryptGenRandom
CryptReleaseContext
CryptAcquireContextA

Sections

.text
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 301KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.drectve
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.eh_fram
Size: 244KB - Virtual size: 244KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.debug_a
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_i
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_l
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_f
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_l
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_p
Size: 1024B - Virtual size: 844B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_p
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_a
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_r
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug_s
Size: 512B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

23ae653dae2394a7404432ff4da197bb

Headers

DLL Characteristics

File Characteristics

Imports

mfc100

msvcr100

kernel32

user32

gdi32

shell32

comctl32

ole32

gdiplus

msvcp100

advapi32

Sections

.text Size: 3.7MB - Virtual size: 3.7MB

.text.un Size: 103KB - Virtual size: 103KB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 5KB - Virtual size: 301KB

.drectve Size: 1KB - Virtual size: 1KB

.eh_fram Size: 244KB - Virtual size: 244KB

.rodata Size: 1KB - Virtual size: 1KB

.debug_a Size: 4KB - Virtual size: 4KB

.debug_i Size: 19KB - Virtual size: 19KB

.debug_l Size: 7KB - Virtual size: 6KB

.debug_f Size: 3KB - Virtual size: 3KB

.debug_l Size: 30KB - Virtual size: 29KB

.debug_p Size: 1024B - Virtual size: 844B

.debug_p Size: 1KB - Virtual size: 1KB

.debug_a Size: 512B - Virtual size: 480B

.debug_r Size: 1024B - Virtual size: 912B

.debug_s Size: 512B - Virtual size: 214B

.rsrc Size: 27KB - Virtual size: 27KB

.reloc Size: 74KB - Virtual size: 73KB

.text
Size: 3.7MB - Virtual size: 3.7MB

.text.un
Size: 103KB - Virtual size: 103KB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 5KB - Virtual size: 301KB

.drectve
Size: 1KB - Virtual size: 1KB

.eh_fram
Size: 244KB - Virtual size: 244KB

.rodata
Size: 1KB - Virtual size: 1KB

.debug_a
Size: 4KB - Virtual size: 4KB

.debug_i
Size: 19KB - Virtual size: 19KB

.debug_l
Size: 7KB - Virtual size: 6KB

.debug_f
Size: 3KB - Virtual size: 3KB

.debug_l
Size: 30KB - Virtual size: 29KB

.debug_p
Size: 1024B - Virtual size: 844B

.debug_p
Size: 1KB - Virtual size: 1KB

.debug_a
Size: 512B - Virtual size: 480B

.debug_r
Size: 1024B - Virtual size: 912B

.debug_s
Size: 512B - Virtual size: 214B

.rsrc
Size: 27KB - Virtual size: 27KB

.reloc
Size: 74KB - Virtual size: 73KB