50489767f26da08f6cd488e76403b3f96f9ee4114a928453a7a5c9f42e6771a0

Sharing

Copy URL Twitter E-mail

General

Target

50489767f26da08f6cd488e76403b3f96f9ee4114a928453a7a5c9f42e6771a0
Size

398KB
MD5

75d4c477f1abac48a05bddac947ade02
SHA1

3228d747058004e93337142d2eb7e8eb4cfd3504
SHA256

50489767f26da08f6cd488e76403b3f96f9ee4114a928453a7a5c9f42e6771a0
SHA512

19033fbd03a955ee262a2c7839b701d00116f8026c9347505d30542d86c0a2014a348804452d29676ee219e55b4a5dc2bdd14131c6c7ac00f3aaadb96a4722b3
SSDEEP

12288:hNqZruiB5EHCibmRAkoPusAOpyBCdbfI:h8ZHEFMAkoPKOpbbfI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
50489767f26da08f6cd488e76403b3f96f9ee4114a928453a7a5c9f42e6771a0

Files

50489767f26da08f6cd488e76403b3f96f9ee4114a928453a7a5c9f42e6771a0
.dll windows x86

e6c693c97619c748a794a65546ca1606

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shell32

SHGetSpecialFolderPathA
SHFileOperationA

shlwapi

PathIsRelativeA

kernel32

CreateFileW
InitializeSListHead
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
CreateFileA
SetEndOfFile
SetFilePointerEx
CloseHandle
GetLastError
GetFileSizeEx
ReadFile
WriteFile
MultiByteToWideChar
DeleteFileA
GetFileInformationByHandle
GetVersionExA
GetProcAddress
GetModuleHandleA
GetFileAttributesExA
GetFileAttributesA
GetFullPathNameA
GetTempPathA
GetTempFileNameA
GetTempPathW
GetTempFileNameW
DeleteFileW
CopyFileA
CreateDirectoryA
GetDiskFreeSpaceExA
SetCurrentDirectoryA
CreateProcessA
WaitForSingleObject
GetModuleFileNameA
FindFirstFileA
FindNextFileA
FindClose
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
GetCurrentThreadId
ResetEvent
SetEvent
DeleteCriticalSection
GetSystemTimeAsFileTime
DisableThreadLibraryCalls

msvcp140

?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?flags@ios_base@std@@QBEHXZ
?good@ios_base@std@@QBE_NXZ
?rdstate@ios_base@std@@QBEHXZ
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?uncaught_exception@std@@YA_NXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ

vcruntime140

strchr
_purecall
__std_terminate
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__CxxFrameHandler3
memchr
memcpy
memmove
strrchr
__std_type_info_destroy_list
_except_handler4_common
__current_exception_context
__current_exception
memset

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
terminate
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_errno
strerror
_cexit
_crt_atexit
_crt_at_quick_exit

api-ms-win-crt-string-l1-1-0

strncmp
wcscpy_s
_stricmp
strnlen
tolower
_strnicmp
strncpy_s
strncpy
_strdup
strcpy_s

api-ms-win-crt-heap-l1-1-0

calloc
malloc
realloc
_callnewh
free

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vsnprintf_s
_fileno
__stdio_common_vfprintf
__stdio_common_vsscanf
_ftelli64
_fseeki64
fclose
ferror
_setmode
feof
fread
fwrite
__stdio_common_vswprintf_s
_wfopen
__stdio_common_vsprintf_s
fopen
fopen_s

api-ms-win-crt-math-l1-1-0

_CItanh
_libm_sse2_log10_precise
_libm_sse2_pow_precise
_except1
ldexp
floor
lround
__libm_sse2_log
frexp

api-ms-win-crt-locale-l1-1-0

setlocale

api-ms-win-crt-convert-l1-1-0

strtod

api-ms-win-crt-filesystem-l1-1-0

_stat64
_wunlink
_wrename
_splitpath_s
_fullpath
_wfullpath
_wchmod
_wsplitpath_s
_fstat64
_unlink
_chmod
_wstat64
rename

api-ms-win-crt-time-l1-1-0

_wutime64
_utime64

api-ms-win-crt-utility-l1-1-0

qsort

Exports

Exports

??0FlacFileStreamWrapper@@QAE@XZ
??0FlacWrapper@nTrack@@QAE@$$QAV01@@Z
??0FlacWrapper@nTrack@@QAE@ABV01@@Z
??0FlacWrapper@nTrack@@QAE@XZ
??1FlacFileStreamWrapper@@QAE@XZ
??1FlacWrapper@nTrack@@QAE@XZ
??4FlacFileStreamWrapper@@QAEAAV0@ABV0@@Z
??4FlacWrapper@nTrack@@QAEAAV01@$$QAV01@@Z
??4FlacWrapper@nTrack@@QAEAAV01@ABV01@@Z
?Convert@FlacWrapper@nTrack@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V34@0AA_N@Z
?Convert@FlacWrapper@nTrack@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V34@AA_N@Z
?Finish@FlacFileStreamWrapper@@QAE_NXZ
?GetBitPerSample@FlacFileStreamWrapper@@QAEHXZ
?GetLastBlockSize@FlacFileStreamWrapper@@QAEHXZ
?GetLastWriteBuffer@FlacFileStreamWrapper@@QAEPAHXZ
?GetNumChannels@FlacFileStreamWrapper@@QAEHXZ
?GetNumFrames@FlacFileStreamWrapper@@QAEHXZ
?GetSampleRate@FlacFileStreamWrapper@@QAEHXZ
?Init@FlacFileStreamWrapper@@QAEHV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?ProcessBlock@FlacFileStreamWrapper@@QAEXXZ
?ProcessMetadata@FlacFileStreamWrapper@@QAEXXZ
?Seek@FlacFileStreamWrapper@@QAEXH@Z
?UnpackFlacToWav@@YAXV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?UnpackFlacToWavSingle@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@Z
?progressRoute@FlacWrapper@nTrack@@AAEXM@Z

Sections

.text
Size: 330KB - Virtual size: 330KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e6c693c97619c748a794a65546ca1606

Headers

DLL Characteristics

File Characteristics

Imports

shell32

shlwapi

kernel32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

Exports

Exports

Sections

.text Size: 330KB - Virtual size: 330KB

.rdata Size: 42KB - Virtual size: 42KB

.data Size: 6KB - Virtual size: 215KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 15KB - Virtual size: 15KB

.text
Size: 330KB - Virtual size: 330KB

.rdata
Size: 42KB - Virtual size: 42KB

.data
Size: 6KB - Virtual size: 215KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 15KB - Virtual size: 15KB