2dafe2d79acf5f3f396d57ee8001a9cf5da15517ae241dabe31b24bfd161b196

Sharing

Copy URL

Twitter E-mail

General

Target

2dafe2d79acf5f3f396d57ee8001a9cf5da15517ae241dabe31b24bfd161b196
Size

628KB
MD5

381a199c9ad1abe298dfad1248738f62
SHA1

b03c6e0388286c6ef636f1582bc463a1e5966fab
SHA256

2dafe2d79acf5f3f396d57ee8001a9cf5da15517ae241dabe31b24bfd161b196
SHA512

14d388290028310fb5e5b1c911408a89b36a241f2b8b7be1a3a20baae99ea14734d1688d5de8cbcd4225b78c46eee1049a8af2e1147b46a48ed6e9b417fc0358
SSDEEP

12288:v2IcrTUbjS9v6KEKE7CFTyeCxnOJcoZiF:v2IcyjYvHEVCF2ek0cYiF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2dafe2d79acf5f3f396d57ee8001a9cf5da15517ae241dabe31b24bfd161b196

Files

2dafe2d79acf5f3f396d57ee8001a9cf5da15517ae241dabe31b24bfd161b196
.dll windows x64

c6c5b9beb6d46916f044d2e6a642240f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

oleaut32

VariantClear
SysAllocString
SysFreeString

shell32

ExtractIconExA
ExtractIconExW

user32

FindWindowExW
GetParent
GetForegroundWindow
GetLayeredWindowAttributes
GetAncestor
DestroyIcon
LoadCursorW
GetWindow
GetWindowThreadProcessId
GetClassNameW
EnumWindows
GetShellWindow
EnumChildWindows
GetWindowLongW
IsRectEmpty
GetWindowTextLengthW
GetWindowTextW
GetWindowDC
GetWindowPlacement
SetWindowPos
SetForegroundWindow
ShowWindow
DestroyWindow
CreateWindowExW
PostThreadMessageA
DefWindowProcW
SendMessageTimeoutW
GetMonitorInfoW
MonitorFromWindow
GetCursorInfo
EnumDisplaySettingsExW
ReleaseDC
GetDC
GetSystemMetrics
GetIconInfo
GetMessageW
RegisterClassW
SetLayeredWindowAttributes
BeginPaint
EndPaint
SetWindowRgn
InvalidateRect
SetClassLongPtrW
ScreenToClient
OpenInputDesktop
SetThreadDesktop
CloseDesktop
GetThreadDesktop
GetUserObjectInformationW
LoadIconW
SetWinEventHook
UnhookWinEvent
UnregisterClassW
DispatchMessageW
TranslateMessage
IsIconic
IsWindowVisible
IsWindow
PtInRect
EnumDisplayDevicesW
PostMessageW
RegisterClassExW
SystemParametersInfoW
AttachThreadInput
PrintWindow
WindowFromPoint
GetWindowRect

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime

kernel32

HeapSize
WriteConsoleW
GetProcessHeap
FreeEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
FreeLibrary
GetProcAddress
LoadLibraryW
ExitProcess
GetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
Sleep
GetCurrentThreadId
RaiseException
GetStdHandle
WriteFile
IsDebuggerPresent
OutputDebugStringA
FormatMessageA
CloseHandle
SetLastError
WaitForSingleObject
CreateThread
GetCurrentThread
ResetEvent
CreateEventW
GetCommandLineW
LocalFree
WideCharToMultiByte
CreateFileW
MultiByteToWideChar
SetFilePointerEx
GetCurrentProcess
GetVersionExW
GetNativeSystemInfo
GetModuleHandleW
LoadLibraryA
TlsAlloc
TlsGetValue
TlsSetValue
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
SetEvent
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
GetExitCodeThread
WaitForSingleObjectEx
FormatMessageW
ProcessIdToSessionId
TlsFree
LoadLibraryExA
GetModuleHandleExA
OpenProcess
RtlUnwindEx
GetCurrentProcessId
GetSystemTimeAsFileTime
LocalAlloc
GetModuleHandleExW
GetModuleFileNameW
GetModuleFileNameA
GetSystemTimes
QueryThreadCycleTime
GetProcessTimes
QueryPerformanceFrequency
QueryPerformanceCounter
RtlPcToFileHeader
InterlockedFlushSList
RtlUnwind
LoadLibraryExW
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
HeapAlloc
HeapFree
FreeLibraryAndExitThread
ExitThread
GetFileType

ole32

CoCreateInstance
CoSetProxyBlanket
CoInitializeEx
CoUninitialize

agora_rtc_sdk

ord8
ord9
ord6

dwmapi

DwmRegisterThumbnail
DwmUnregisterThumbnail
DwmUpdateThumbnailProperties

d3d9

Direct3DCreate9

gdi32

EndPath
BeginPath
SetBkMode
Rectangle
GetStockObject
CreateSolidBrush
GetDeviceCaps
GetObjectW
GetCurrentObject
CreateDIBSection
SelectObject
DeleteObject
DeleteDC
CreateCompatibleDC
BitBlt
PathToRegion
GetDIBits

psapi

GetModuleFileNameExW
GetProcessImageFileNameW

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

Sections

.text
Size: 407KB - Virtual size: 406KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 191KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c6c5b9beb6d46916f044d2e6a642240f

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

oleaut32

shell32

user32

winmm

kernel32

ole32

agora_rtc_sdk

dwmapi

d3d9

gdi32

psapi

d3d11

dxgi

Sections

.text Size: 407KB - Virtual size: 406KB

.rdata Size: 191KB - Virtual size: 190KB

.data Size: 5KB - Virtual size: 13KB

.pdata Size: 18KB - Virtual size: 18KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 1024B - Virtual size: 880B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 407KB - Virtual size: 406KB

.rdata
Size: 191KB - Virtual size: 190KB

.data
Size: 5KB - Virtual size: 13KB

.pdata
Size: 18KB - Virtual size: 18KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 1024B - Virtual size: 880B

.reloc
Size: 4KB - Virtual size: 3KB