9a944521217921979f89c5f7ed3aabd5ad03e020bd36679ef2e59ccc895673c1

Sharing

Copy URL

Twitter E-mail

General

Target

9a944521217921979f89c5f7ed3aabd5ad03e020bd36679ef2e59ccc895673c1
Size

477KB
MD5

7672ae8a15375415a182471bcd6603cf
SHA1

38cb564c422816ec0966a108de2bc171c2080096
SHA256

9a944521217921979f89c5f7ed3aabd5ad03e020bd36679ef2e59ccc895673c1
SHA512

7da51d1592b0b4de6c802f43c50cbc72e0fcbb04972021b64dafcfc45f49a8c40ce3e25c9ac130375b6639f7bbe7966903753ee3177a5550c5b35b05356cb399
SSDEEP

12288:IQ/Ye3URQGtyJLfDo8Csssm8xC0a33TqqZVr9enNmjdvbFhRRRiiiiD555Bp6wk3:hQeSk0cYHBKSTY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9a944521217921979f89c5f7ed3aabd5ad03e020bd36679ef2e59ccc895673c1

Files

9a944521217921979f89c5f7ed3aabd5ad03e020bd36679ef2e59ccc895673c1
.dll regsvr32 windows x86

9ebd3b2b38e13497fc532ed548aa148f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
CreateFileA
WriteFile
CreateFileW
DecodePointer
RaiseException
InitializeCriticalSectionEx
DeleteCriticalSection
GetCurrentProcessId
CreateThread
LoadLibraryW
MoveFileW
CreateDirectoryA
CreateDirectoryW
GetLongPathNameA
FindClose
FindFirstFileW
FindNextFileW
GetCurrentDirectoryW
DeleteFileW
GetFileAttributesExW
RemoveDirectoryW
SetUnhandledExceptionFilter
CreatePipe
DeviceIoControl
InitializeCriticalSection
ReleaseMutex
LeaveCriticalSection
ReleaseSemaphore
WaitForSingleObject
CreateRemoteThread
GetCurrentThreadId
SetThreadPriority
GetExitCodeThread
ResumeThread
CreateProcessA
GetSystemDirectoryA
VirtualProtect
VirtualQuery
VirtualAllocEx
WriteProcessMemory
MapViewOfFile
UnmapViewOfFile
FreeLibrary
GetModuleFileNameW
CreateSemaphoreA
CreateFileMappingA
OpenFileMappingA
GetLogicalDriveStringsA
CopyFileW
GetTimeZoneInformation
SetConsoleCtrlHandler
GetVersionExA
LoadLibraryA
CreateMutexA
GetLastError
EnterCriticalSection
CloseHandle
LocalFree
WideCharToMultiByte
MultiByteToWideChar
OutputDebugStringW
FlushInstructionCache
SetLastError
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
DisableThreadLibraryCalls
GetTickCount
OpenProcess
GetCommandLineA

user32

GetClassNameA
EnumWindows
FindWindowA
GetWindowTextA
keybd_event
DefWindowProcA
RegisterClassA
CreateWindowExA
ShowWindow
LoadStringA
MoveWindow
GetWindowThreadProcessId
mouse_event
UnregisterClassA
ClipCursor
DrawTextA
SetWindowLongA
GetWindowLongA
OffsetRect
ScreenToClient
ClientToScreen
GetCursor
GetCursorPos
SetCursor
SetCursorPos
MessageBoxA
GetWindowRect
GetClientRect
ReleaseDC
GetDC
SetWindowPos
GetForegroundWindow
GetSystemMetrics
GetAsyncKeyState
GetFocus
GetActiveWindow
SetFocus

gdi32

GetDeviceCaps
SetStretchBltMode
StretchBlt

advapi32

RegSetValueExW
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegCreateKeyExA

ole32

CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoCreateInstance
CoSetProxyBlanket

oleaut32

SysFreeString
GetErrorInfo
VariantInit
VariantChangeType
SetErrorInfo
SysAllocString
CreateErrorInfo
VariantClear

msvcp140

?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z

vcruntime140

memset
strstr
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__CxxFrameHandler3
memcpy
memmove
_purecall
__std_terminate
memcmp
__current_exception
_except_handler3
__std_type_info_destroy_list
_except_handler4_common
__current_exception_context

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo
_exit
_errno
_invalid_parameter_noinfo_noreturn
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
exit
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
terminate
_initterm
_initterm_e
_register_onexit_function

api-ms-win-crt-string-l1-1-0

_strlwr
_wcslwr
wcsncmp
strcmp
strcpy
strcat
_stricmp
strncpy
tolower
isspace

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf
ftell
fflush
fwrite
fseek
fread
feof
_wfopen
_open_osfhandle
__stdio_common_vsprintf
fgets
fopen
__stdio_common_vsscanf
__stdio_common_vswprintf
fclose

api-ms-win-crt-heap-l1-1-0

free
malloc
_callnewh
realloc
_recalloc

api-ms-win-crt-convert-l1-1-0

wcstombs
mbstowcs

api-ms-win-crt-time-l1-1-0

_time64
_localtime64

api-ms-win-crt-utility-l1-1-0

rand
srand

api-ms-win-crt-math-l1-1-0

_fdopen

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_wchmod
_wstat64i32

Exports

Exports

AcquireDDThreadLock
CheckFullscreen
CompleteCreateSysmemSurface
D3DPERF_BeginEvent
D3DPERF_EndEvent
D3DPERF_GetStatus
D3DPERF_QueryRepeatFrame
D3DPERF_SetMarker
D3DPERF_SetOptions
D3DPERF_SetRegion
D3DParseUnknownCommand
DDGetAttachedSurfaceLcl
DDInternalLock
DDInternalUnlock
DSoundHelp
DebugSetLevel
DebugSetMute
Direct3DCreate8
Direct3DCreate9
Direct3DShaderValidatorCreate9
DirectDrawCreate
DirectDrawCreateClipper
DirectDrawCreateEx
DirectDrawEnumerateA
DirectDrawEnumerateExA
DirectDrawEnumerateExW
DirectDrawEnumerateW
DirectPlayCreate
DirectPlayEnumerate
DirectPlayEnumerateA
DirectPlayEnumerateW
DirectPlayLobbyCreateA
DirectPlayLobbyCreateW
DirectSoundCaptureCreate
DirectSoundCaptureCreate8
DirectSoundCaptureEnumerateA
DirectSoundCaptureEnumerateW
DirectSoundCreate
DirectSoundCreate8
DirectSoundEnumerateA
DirectSoundEnumerateW
DirectSoundFullDuplexCreate
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetDDSurfaceLocal
GetDeviceID
GetIFactory
GetOLEThunkData
GetSurfaceFromDC
GetUserNameA
Ordinal1
Ordinal10
Ordinal11
Ordinal12
Ordinal13
Ordinal14
Ordinal15
Ordinal16
Ordinal17
Ordinal18
Ordinal19
Ordinal2
Ordinal3
Ordinal4
Ordinal5
Ordinal6
Ordinal7
Ordinal8
Ordinal9
PSGPError
PSGPSampleTexture
RegCloseKey
RegCreateKeyExA
RegEnumValueA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegisterSpecialCase
ReleaseDDThreadLock
SetAppCompatData
ShellExecuteA
_DllMain@12
gdwDPlaySPRefCount

Sections

.text
Size: 387KB - Virtual size: 387KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9ebd3b2b38e13497fc532ed548aa148f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

Exports

Exports

Sections

.text Size: 387KB - Virtual size: 387KB

.rdata Size: 66KB - Virtual size: 65KB

.data Size: 2KB - Virtual size: 30KB

.reloc Size: 20KB - Virtual size: 20KB

.text
Size: 387KB - Virtual size: 387KB

.rdata
Size: 66KB - Virtual size: 65KB

.data
Size: 2KB - Virtual size: 30KB

.reloc
Size: 20KB - Virtual size: 20KB