29b260d0b3a7839b05034df7b8ce65153f77d16ff032bf77eb3d32a52b078f53

Sharing

Copy URL Twitter E-mail

General

Target

29b260d0b3a7839b05034df7b8ce65153f77d16ff032bf77eb3d32a52b078f53
Size

1.5MB
MD5

e8fbf950b1dd932253f74967bdb80628
SHA1

334d45fc629881830a71fa8d834ff70367f80154
SHA256

29b260d0b3a7839b05034df7b8ce65153f77d16ff032bf77eb3d32a52b078f53
SHA512

4ebeb8c7371f648ff4002969e9e7c93634bd4a03a76a8ab19135fd9b6b1701640d3daa016f147bf69a65daa8000734eb21db0399e2e0f380bfb13062aa522c18
SSDEEP

24576:RwLfrXNh5lQ3DTUIhcXZOkXF/WShevbgU0hu+Un2EAAoiPmKNyTPb0gEgDeqn64d:RAdh5lQ3DTUAkXFevbCEAAA6yTzDznPd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29b260d0b3a7839b05034df7b8ce65153f77d16ff032bf77eb3d32a52b078f53

Files

29b260d0b3a7839b05034df7b8ce65153f77d16ff032bf77eb3d32a52b078f53
.exe windows:6 windows x86

e282f27c10db9a7c3d6405212cacb100

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ddraw

DirectDrawCreate

dsound

ord1

winmm

mmioOpenA
mmioClose
timeGetTime
mmioRead
mmioAscend
mmioDescend
mciSendCommandA

dinput

DirectInputCreateA

wsock32

send
closesocket
__WSAFDIsSet
recv
WSACleanup
WSAGetLastError
select
WSAStartup
gethostbyname
socket
setsockopt
htons
ioctlsocket
connect
inet_ntoa

lua51

luaL_checknumber
luaL_buffinit
luaL_addvalue
luaL_prepbuffer
luaL_addlstring
lua_pushstring
luaL_checkinteger
luaL_register
luaL_checklstring
lua_pushnumber
lua_pushvalue
lua_gettop
luaL_error
lua_tolstring
luaL_newstate
lua_type
lua_pushcclosure
lua_pcall
lua_tonumber
lua_call
lua_isnumber
lua_remove
lua_gc
luaL_openlibs
lua_getfield
lua_insert
lua_isstring
luaL_loadstring
lua_pushinteger
lua_settop

kernel32

TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetOEMCP
IsValidCodePage
HeapSize
GetStartupInfoW
ReadConsoleW
GetConsoleMode
RtlUnwind
DeleteCriticalSection
GetModuleFileNameW
GetStdHandle
RaiseException
GetCommandLineA
PeekNamedPipe
GetFileType
GetFileInformationByHandle
FileTimeToLocalFileTime
AreFileApisANSI
GetModuleHandleExW
GetSystemTimeAsFileTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
IsProcessorFeaturePresent
ExitProcess
OpenProcess
CreateProcessA
TerminateProcess
GetLastError
SetLastError
CloseHandle
GetCurrentProcess
VirtualFree
VirtualAlloc
VirtualProtect
GetCurrentThreadId
UnmapViewOfFile
WriteFile
DeleteFileW
LoadLibraryExW
TlsFree
GetProcAddress
GetTickCount
lstrcatA
FindFirstFileA
FindClose
FindNextFileA
lstrcpyA
IsDBCSLeadByte
GetCurrentDirectoryA
GlobalLock
GlobalUnlock
LCMapStringA
CreateFileA
HeapAlloc
HeapFree
GetProcessHeap
ReadFile
Sleep
CreateDirectoryA
ReleaseMutex
CreateThread
WideCharToMultiByte
MultiByteToWideChar
GetPrivateProfileStringA
WritePrivateProfileStringA
GetComputerNameA
MapViewOfFile
SetErrorMode
Process32First
K32EnumProcessModules
K32GetModuleFileNameExA
GetACP
Process32Next
CreateFileMappingA
K32EnumProcesses
GetModuleFileNameA
CreateMutexA
CreateToolhelp32Snapshot
QueryPerformanceFrequency
GetCurrentProcessId
OpenFileMappingA
DeleteFileA
QueryPerformanceCounter
CreateEventA
ExitThread
WaitForMultipleObjects
HeapDestroy
HeapCreate
GetSystemInfo
IsDebuggerPresent
DecodePointer
EncodePointer
LeaveCriticalSection
EnterCriticalSection
FlushFileBuffers
GetConsoleCP
SetFilePointerEx
FindFirstFileExW
FindNextFileW
GetTimeZoneInformation
CreateDirectoryW
SetStdHandle
GetModuleHandleW
GetFileAttributesExW
GetEnvironmentStringsW
FreeEnvironmentStringsW
OutputDebugStringW
HeapReAlloc
GetStringTypeW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
CompareStringW
LCMapStringW
WriteConsoleW
SetEnvironmentVariableA
CreateFileW
SetEndOfFile

user32

GetDC
TranslateMessage
OffsetRect
SetRect
SetWindowLongA
MessageBoxA
GetClientRect
PeekMessageA
ReleaseDC
DefWindowProcA
PostQuitMessage
ShowWindow
DispatchMessageA
CreateWindowExA
LoadIconA
GetKeyboardLayout
GetAsyncKeyState
wsprintfA
OpenClipboard
GetClipboardData
CloseClipboard
ClientToScreen
DestroyWindow
GetKeyState
SetWindowPos
PostMessageA
ShowCursor
AdjustWindowRectEx
UpdateWindow
LoadCursorA
ChangeDisplaySettingsA
RegisterClassA
SetWindowTextA
SetTimer

gdi32

CreateCompatibleDC
SelectObject
SetTextColor
CreateFontA
GetTextExtentPoint32A
GetStockObject
GetDeviceCaps
SetBkMode
DeleteObject
CreateDCA
TextOutA

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

shell32

ShellExecuteA

vmprotectsdk32

VMProtectDecryptStringA
VMProtectIsDebuggerPresent
VMProtectIsVirtualMachinePresent
VMProtectEnd
VMProtectBegin

netapi32

Netbios

libeay32

ord339

imm32

ImmDestroyContext
ImmCreateContext
ImmSetOpenStatus
ImmGetOpenStatus
ImmGetProperty
ImmIsIME
ImmGetConversionStatus
ImmGetDescriptionA
ImmGetCompositionStringA
ImmGetCandidateListA
ImmAssociateContext

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 105KB - Virtual size: 154.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e282f27c10db9a7c3d6405212cacb100

Headers

DLL Characteristics

File Characteristics

Imports

ddraw

dsound

winmm

dinput

wsock32

lua51

kernel32

user32

gdi32

advapi32

shell32

vmprotectsdk32

netapi32

libeay32

imm32

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 109KB - Virtual size: 108KB

.data Size: 105KB - Virtual size: 154.0MB

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 84KB - Virtual size: 83KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 109KB - Virtual size: 108KB

.data
Size: 105KB - Virtual size: 154.0MB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 84KB - Virtual size: 83KB