9157e6f9f9399d2745ba8c3dbeedf6a8f3da4336ce5288cf31baef6050d0830f

Sharing

Copy URL Twitter E-mail

General

Target

9157e6f9f9399d2745ba8c3dbeedf6a8f3da4336ce5288cf31baef6050d0830f
Size

4.7MB
MD5

acc6b316a44ece5c38db845bae34b2be
SHA1

e33900b9e2af4490fc33872eadcfd534c529bc38
SHA256

9157e6f9f9399d2745ba8c3dbeedf6a8f3da4336ce5288cf31baef6050d0830f
SHA512

ed8b73c1b8906acada130a6390288c93b1c3482991742047d8e8aa642b80186db04f853beb0819476a7d55cae5c314c62771934579b3e142bd76adc48d6271e8
SSDEEP

49152:Wgl6W/2UIt+q8jCnm39/YPU6vp7iRYulZWrBdlth4yP7OekOzQHCeiJf/6mMnnWe:VYVB7LoHikKq+DG+V

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9157e6f9f9399d2745ba8c3dbeedf6a8f3da4336ce5288cf31baef6050d0830f

Files

9157e6f9f9399d2745ba8c3dbeedf6a8f3da4336ce5288cf31baef6050d0830f
.dll windows x64

4c3a7db0f77324248eae31dbf720dc24

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

vmprotectsdk64

VMProtectFreeString
VMProtectBeginMutation
VMProtectDecryptStringA
VMProtectBeginUltra
VMProtectEnd

ws2_32

bind
WSAStartup
WSACleanup
freeaddrinfo
closesocket
WSAGetLastError
getsockopt
recv
WSARecv
listen
WSASend
getsockname
send
accept
select
connect
getaddrinfo
WSASocketW
getpeername
ioctlsocket
setsockopt

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
SystemFunction036

ntdll

RtlCaptureContext
RtlVirtualUnwind
NtWriteFile
RtlNtStatusToDosError
RtlLookupFunctionEntry

bcrypt

BCryptGenRandom

vulkan-1

vkDestroyImage
vkDestroyImageView
vkGetBufferMemoryRequirements
vkDestroyShaderModule
vkDestroyPipeline
vkBindBufferMemory
vkFlushMappedMemoryRanges
vkUnmapMemory
vkDestroyPipelineLayout
vkMapMemory
vkFreeMemory
vkDestroySampler
vkAllocateMemory
vkDestroyDescriptorSetLayout
vkCmdBindPipeline
vkCmdSetViewport
vkCmdSetScissor
vkCmdBindDescriptorSets
vkCmdBindIndexBuffer
vkGetPhysicalDeviceMemoryProperties
vkCmdBindVertexBuffers
vkGetDeviceQueue
vkGetPhysicalDeviceQueueFamilyProperties
vkCmdDrawIndexed
vkDestroyBuffer
vkCreateBuffer
vkCmdPushConstants

kernel32

GetSystemDirectoryW
CreateNamedPipeW
GetFullPathNameW
GetModuleFileNameW
FormatMessageW
CreateProcessW
GetFileAttributesW
WriteConsoleW
TlsGetValue
TlsSetValue
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetWindowsDirectoryW
InitializeSListHead
RaiseException
CreateFileW
CreateMutexA
WaitForSingleObjectEx
AcquireSRWLockShared
GetProcessHeap
SleepConditionVariableSRW
WakeAllConditionVariable
TerminateProcess
GetExitCodeProcess
WaitForSingleObject
ReadFileEx
SleepEx
WriteFileEx
SetHandleInformation
DuplicateHandle
GetEnvironmentVariableW
GetEnvironmentStringsW
GetCurrentDirectoryW
SetLastError
GetCurrentThread
SetThreadStackGuarantee
CompareStringOrdinal
ReleaseSRWLockShared
ReleaseMutex
FreeEnvironmentStringsW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
WriteConsoleA
GetConsoleMode
WriteFile
GetStdHandle
GetDynamicTimeZoneInformation
GetFileAttributesA
VirtualQuery
K32EnumProcessModules
GetCurrentProcess
GetProcAddress
Sleep
DisableThreadLibraryCalls
CreateThread
CloseHandle
GetModuleHandleA
LoadLibraryA
GetModuleHandleExA
GetLastError
GetModuleFileNameA
GetSystemDirectoryA
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
FreeLibrary
HeapAlloc
HeapReAlloc
HeapFree
GetCurrentProcessId
GetCurrentThreadId
VirtualProtect
GetModuleHandleW

user32

LoadCursorA
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
GetClientRect
GetForegroundWindow
SetCursorPos
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
GetAsyncKeyState
GetKeyState

msvcp140

?_Syserror_map@std@@YAPEBDH@Z
_Cnd_signal
_Cnd_destroy_in_situ
_Thrd_id
_Thrd_join
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_unlock
_Mtx_lock
_Xtime_get_ticks
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??Bid@locale@std@@QEAA_KXZ
?id@?$numpunct@D@std@@2V0locale@2@A
?_Xbad_alloc@std@@YAXXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
_Query_perf_counter
_Query_perf_frequency
_Mtx_destroy_in_situ
_Mtx_init_in_situ
?_Incref@facet@locale@std@@UEAAXXZ
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ

imm32

ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext
ImmReleaseContext

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp
_CxxThrowException
__CxxFrameHandler3
__C_specific_handler
__current_exception
memmove
__std_type_info_destroy_list
__C_specific_handler_noexcept
__vcrt_GetModuleFileNameW
__vcrt_LoadLibraryExW
memcpy
_purecall
__std_terminate
memset
__current_exception_context
__std_exception_copy
memchr
strstr
__std_exception_destroy

api-ms-win-crt-heap-l1-1-0

malloc
free
calloc
_callnewh

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_errno
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
terminate
_invalid_parameter_noinfo_noreturn
_register_onexit_function

api-ms-win-crt-convert-l1-1-0

atof
mbstowcs
strtoll
strtol
strtod

api-ms-win-crt-stdio-l1-1-0

fputs
_fsopen
__stdio_common_vsscanf
__stdio_common_vsprintf
fwrite
fflush
_wfopen
fread
fseek
__stdio_common_vsprintf_s
__acrt_iob_func
__stdio_common_vfprintf
ftell
_wfopen_s
fclose

api-ms-win-crt-string-l1-1-0

strcat_s
toupper
isdigit
strncmp
strncpy
strcmp
strlen
strcpy_s

api-ms-win-crt-math-l1-1-0

cosf
ceilf
acosf
sqrtf
fmodf
logf
_dsign
_fdsign
pow
powf
log
_ldsign
_dclass
_fdclass
sinf
_ldclass
log2f

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s
strftime
_gmtime64_s

api-ms-win-crt-filesystem-l1-1-0

_mkdir

Exports

Exports

CreateDXGIFactory
CreateDXGIFactory1
CreateDXGIFactory2
DESCRIPTION
DXGIDeclareAdapterRemovalSupport
DXGIGetDebugInterface1
GetFileVersionInfoA
GetFileVersionInfoExA
GetFileVersionInfoExW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeExA
GetFileVersionInfoSizeExW
GetFileVersionInfoSizeW
GetFileVersionInfoW
NAME
VerFindFileA
VerFindFileW
VerInstallFileA
VerInstallFileW
VerLanguageNameA
VerLanguageNameW
VerQueryValueA
VerQueryValueW

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 153KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4c3a7db0f77324248eae31dbf720dc24

Headers

DLL Characteristics

File Characteristics

Imports

vmprotectsdk64

ws2_32

advapi32

ntdll

bcrypt

vulkan-1

kernel32

user32

msvcp140

imm32

d3dcompiler_47

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

Exports

Exports

Sections

.text Size: 3.0MB - Virtual size: 3.0MB

.rdata Size: 1.5MB - Virtual size: 1.5MB

.data Size: 17KB - Virtual size: 24KB

.pdata Size: 153KB - Virtual size: 153KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 20KB - Virtual size: 20KB

.text
Size: 3.0MB - Virtual size: 3.0MB

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 17KB - Virtual size: 24KB

.pdata
Size: 153KB - Virtual size: 153KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 20KB - Virtual size: 20KB