547abb4d1c014cb676e16549e9b674ac54e5358316721a80004354d21f29d537

Sharing

Copy URL Twitter E-mail

General

Target

547abb4d1c014cb676e16549e9b674ac54e5358316721a80004354d21f29d537
Size

514KB
MD5

cd66a061f0c8229638bbda52c5211c2c
SHA1

494aff92134c9ba0b62b199490c434494bb39d5d
SHA256

547abb4d1c014cb676e16549e9b674ac54e5358316721a80004354d21f29d537
SHA512

cf3c33cc252ce02a61a9527813b93c32cb2c55d36ca50461953e15a9d07c229fcabb95f28ac4b2fc4786e255b9e1cc5048b755d31d5fbae59558d9705c9f968e
SSDEEP

12288:jTJp61e92ScxJhLHLPDigsWlIwtDP3PvWCtDo:jTJp61QJcxJhLHLP2gsfAPmMo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/unlockfps_clr.exe

Files

547abb4d1c014cb676e16549e9b674ac54e5358316721a80004354d21f29d537
.zip
fps_config.json
unlockfps_clr.exe
.exe windows x64

bde13ba7317631ad3e593620b09fc85e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

SetPriorityClass
GetExitCodeProcess
WriteProcessMemory
ReadProcessMemory
CreateToolhelp32Snapshot
Module32First
Module32Next
CloseHandle
Process32First
Process32Next
CreateProcessA
GetLastError
OpenProcess
QueryFullProcessImageNameA
TerminateProcess
FormatMessageA
LocalFree
VirtualAlloc
VirtualFreeEx
VirtualAllocEx
GetModuleHandleA
GetProcAddress
CreateRemoteThread
WaitForSingleObject
Sleep
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
ReleaseMutex
CreateMutexA
OpenMutexA
LockResource
LoadResource
SizeofResource
FindResourceA

user32

GetSystemMetrics
LoadImageA
SetWinEventHook
MessageBoxA
GetWindowThreadProcessId

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-heap-l1-1-0

free
malloc
_callnewh

api-ms-win-crt-runtime-l1-1-0

_cexit
_invalid_parameter_noinfo_noreturn
abort
terminate

vcruntime140

memset
__std_exception_copy
memmove
__std_exception_destroy
__CxxRegisterExceptionObject
__CxxDetectRethrow
__CxxUnregisterExceptionObject
__FrameUnwindFilter
__CxxFrameHandler3
_CxxThrowException
__current_exception
__CxxExceptionFilter
__current_exception_context
__CxxQueryExceptionSize

msvcp140

_Thrd_sleep
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_counter
_Query_perf_frequency
_Xtime_get_ticks

api-ms-win-crt-math-l1-1-0

ceilf

mscoree

_CorExeMain

Sections

.text
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.nep
Size: 1024B - Virtual size: 544B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bde13ba7317631ad3e593620b09fc85e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

vcruntime140

msvcp140

api-ms-win-crt-math-l1-1-0

mscoree

Sections

.text Size: 41KB - Virtual size: 41KB

.nep Size: 1024B - Virtual size: 544B

.rdata Size: 101KB - Virtual size: 101KB

.data Size: 1024B - Virtual size: 6KB

.pdata Size: 512B - Virtual size: 336B

.rsrc Size: 1.2MB - Virtual size: 1.2MB

.reloc Size: 512B - Virtual size: 76B

.text
Size: 41KB - Virtual size: 41KB

.nep
Size: 1024B - Virtual size: 544B

.rdata
Size: 101KB - Virtual size: 101KB

.data
Size: 1024B - Virtual size: 6KB

.pdata
Size: 512B - Virtual size: 336B

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

.reloc
Size: 512B - Virtual size: 76B