d33b9a04495cc6acc8a58fec6036a8a0daad805756b263b60f813ed2e3be5eec

Sharing

Copy URL Twitter E-mail

General

Target

d33b9a04495cc6acc8a58fec6036a8a0daad805756b263b60f813ed2e3be5eec
Size

9.9MB
MD5

de98711e511e7a2d9caae261c752a378
SHA1

39678121b23c759ab03620721c9da7067f2e5967
SHA256

d33b9a04495cc6acc8a58fec6036a8a0daad805756b263b60f813ed2e3be5eec
SHA512

9a499d19e7942deaf7940197413215b3cc2ebdc208eb0f2266e6621597c84fcd4173d5e56fe9578ef744dd5d0a72923c83fdbd314fb0cfed32dc1adcd26d327c
SSDEEP

98304:bvt7MQMfFbcc0+fLYc1mYyI0Y3Dp225tIBeEIp5Bmv1PXa5zHOZMJyOM:bRAp++fLhCI0gDpl5tcE6v6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d33b9a04495cc6acc8a58fec6036a8a0daad805756b263b60f813ed2e3be5eec

Files

d33b9a04495cc6acc8a58fec6036a8a0daad805756b263b60f813ed2e3be5eec
.exe windows:6 windows x86

c5a0eeff38b57770bf3ae84ada8b099d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SwitchToThread
GetExitCodeThread
GetNativeSystemInfo
CreateThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetDiskFreeSpaceExW
GetFileAttributesW
GetFileAttributesExW
GetFileAttributesA
IsDebuggerPresent
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFullPathNameW
SetFileAttributesW
SetFileTime
DeviceIoControl
GetModuleHandleW
MoveFileExW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
QueryPerformanceFrequency
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
EncodePointer
DecodePointer
InitializeCriticalSectionEx
LCMapStringEx
LocalFree
GetTickCount64
VerifyVersionInfoA
CreateWaitableTimerA
TlsSetValue
TlsGetValue
TerminateThread
QueueUserAPC
WaitForMultipleObjects
SetWaitableTimer
CreateEventW
SleepEx
InitializeCriticalSectionAndSpinCount
CancelIoEx
WaitForSingleObjectEx
CreateIoCompletionPort
RaiseException
SetLastError
QueryPerformanceCounter
CreateSemaphoreA
ReleaseSemaphore
GetLocaleInfoA
TlsAlloc
GetLastError
EnterCriticalSection
LeaveCriticalSection
PostQueuedCompletionStatus
TlsFree
CreateToolhelp32Snapshot
GetCurrentProcessId
Module32First
CloseHandle
InitializeSRWLock
Module32Next
GetCurrentProcess
ReadProcessMemory
GetSystemInfo
Process32First
OpenProcess
Sleep
Process32Next
SetEvent
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSection
CreateEventA
SetFileAttributesA
FindFirstFileA
FindNextFileA
FindClose
GetLocalTime
VerSetConditionMask
VerifyVersionInfoW
CreateDirectoryA
HeapAlloc
GetProcessHeap
HeapFree
GetModuleFileNameA
GetComputerNameA
CreateFileA
GetFileSize
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetStdHandle
SetFilePointerEx
GetFileSizeEx
CreateFileW
WriteFile
SetFilePointer
ReadFile
LoadLibraryA
GetQueuedCompletionStatus
FormatMessageA
OutputDebugStringA
AllocConsole
SetUnhandledExceptionFilter
GetCurrentThreadId
GetProcAddress
PeekConsoleInputA
ReadConsoleInputW
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapCompact
UnlockFileEx
LockFileEx
FlushFileBuffers
SetStdHandle
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
SetConsoleCtrlHandler
InterlockedPushEntrySList
RtlUnwind
GetSystemDirectoryW
ResumeThread
GetModuleHandleExA
GetProcessAffinityMask
lstrcmpA
GetEnvironmentVariableA
CreateThread
GetTickCount
WaitNamedPipeA
CreateNamedPipeA
OpenFileMappingW
CreateFileMappingW
VirtualQuery
GetVersion
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
InitializeProcThreadAttributeList
CreateProcessW
GetExitCodeProcess
ExitProcess
CancelIo
GetOverlappedResult
SetNamedPipeHandleState
ConnectNamedPipe
ExpandEnvironmentStringsW
FlushViewOfFile
DuplicateHandle
SetEndOfFile
GetErrorMode
GetTimeZoneInformation
LoadLibraryExW
WriteConsoleW
GetNumberOfConsoleInputEvents
ResetEvent
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
SetErrorMode
GenerateConsoleCtrlEvent
GetActiveProcessorCount
LoadLibraryW
GetProcessTimes
CreatePipe
RemoveDirectoryW
GetVolumePathNameW
DeleteFileW
SetEnvironmentVariableW
GetSystemTimeAdjustment
GetConsoleOutputCP
GetConsoleCP
SetHandleInformation
GetHandleInformation
GetVersionExW
OutputDebugStringW
FormatMessageW
WaitNamedPipeW
PeekNamedPipe
GetModuleFileNameW
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetACP
GetFileType
GetEnvironmentVariableW
VirtualFree
VirtualProtect
VirtualAlloc
AcquireSRWLockShared
ReleaseSRWLockShared
GetThreadTimes
GetCurrentThread
TerminateProcess
GetStartupInfoW
UnhandledExceptionFilter
InitializeSListHead
CompareStringA
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
GlobalLock
GlobalUnlock
FreeLibrary
GetVersionExA
GetSystemDirectoryA
GetModuleHandleA
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
WriteConsoleA
GetConsoleMode
GetDynamicTimeZoneInformation
IsProcessorFeaturePresent
HeapValidate
GetCPInfo
GetStringTypeW
GetSystemTimeAsFileTime
GetLocaleInfoEx

user32

GetUserObjectInformationW
CharPrevExA
CharNextExA
CharNextW
GetClipboardData
CloseClipboard
OpenClipboard
GetKeyboardLayout
GetKeyboardLayoutNameA
LoadCursorA
SetWindowLongA
GetKeyState
GetWindowLongA
SetRect
AdjustWindowRectEx
InvalidateRect
GetMenu
RegisterClassA
ReleaseDC
GetDC
PostQuitMessage
PeekMessageA
DispatchMessageA
TranslateMessage
GetMessageA
MessageBoxA
GetClientRect
UpdateWindow
SetFocus
MoveWindow
DestroyWindow
IsWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
DefWindowProcA
MessageBoxW
GetSystemMetrics
GetCapture
ShowWindow
ChangeDisplaySettingsA
ReleaseCapture
SetCapture
SetCursorPos
ClientToScreen
SetCursor
ShowCursor
DestroyCursor
LoadImageA
FlashWindowEx
SystemParametersInfoA
SetWindowPos
LoadIconA
FindWindowA
ScreenToClient
GetCursorPos
GetProcessWindowStation

gdi32

GetTextExtentPoint32A
TextOutA
CreateDIBSection
SetBkMode
DeleteDC
CreateCompatibleDC
TextOutW
SetTextColor
SetBkColor
SelectObject
GetTextExtentPoint32W
GetCharABCWidthsFloatW
DeleteObject
CreateFontIndirectA
EnumFontFamiliesExA
GetStockObject

advapi32

CryptSignHashW
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptEncrypt
CryptImportKey
CryptHashData
CryptGetHashParam
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
RegSetValueW
RegSaveKeyW
RegQueryValueW
RegQueryInfoKeyW
RegLoadKeyW
RegFlushKey
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyExW
RegDeleteKeyW
RegCreateKeyW
RegConnectRegistryW
CryptGenRandom
GetUserNameW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptEnumProvidersW
GetUserNameA
CryptDestroyHash
CryptCreateHash
CryptDecrypt

ole32

CoUninitialize
CoInitializeEx
CoCreateInstance

oleaut32

VariantClear
SysFreeString

winmm

timeBeginPeriod
timeGetDevCaps
timeGetTime
timeEndPeriod

d3d8

Direct3DCreate8

version

GetFileVersionInfoSizeA
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoA
VerQueryValueA

ws2_32

WSARecv
WSASocketW
WSAStringToAddressW
WSAIoctl
freeaddrinfo
socket
send
bind
WSASetLastError
listen
getsockopt
getaddrinfo
getsockname
select
recv
connect
accept
WSASend
ioctlsocket
closesocket
WSAGetLastError
setsockopt
getpeername
sendto
recvfrom
inet_pton
inet_ntop
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
shutdown
getservbyname
getservbyport
gethostbyaddr
inet_ntoa
gethostname
gethostbyname
ntohs
WSACleanup
ntohl
inet_addr
__WSAFDIsSet
htons
WSAStartup
htonl

imm32

ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
ImmNotifyIME

rpcrt4

UuidCreateSequential

libcef

cef_string_utf8_clear
cef_string_utf16_clear
cef_string_multimap_free
cef_string_multimap_alloc
cef_log
cef_string_multimap_append
cef_string_multimap_value
cef_string_multimap_key
cef_string_multimap_size
cef_string_map_append
cef_string_map_value
cef_string_map_key
cef_string_map_size
cef_string_list_append
cef_string_list_value
cef_string_list_size
cef_v8context_get_current_context
cef_string_utf8_to_utf16
cef_run_message_loop
cef_shutdown
cef_initialize
cef_execute_process
cef_register_extension
cef_browser_host_create_browser
cef_api_hash
cef_command_line_get_global
cef_string_map_free
cef_string_map_alloc
cef_string_list_free
cef_string_list_alloc
cef_string_userfree_utf16_free
cef_string_utf16_set
cef_string_utf16_cmp
cef_string_utf16_to_utf8

devil

ilShutDown
ilDeleteImages
ilCopyPixels
ilSetPixels
ilGetInteger
ilSave
ilTexImage
ilOriginFunc
ilEnable
ilBindImage
ilGenImages
ilConvertImage
ilInit
ilLoad

mss32

_AIL_mem_free_lock@4
_AIL_file_read@8
_AIL_set_file_callbacks@16
_AIL_WAV_info@8
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_last_error@0
_AIL_allocate_sample_handle@4
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_set_sample_loop_count@8
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_loop_count@8
_AIL_3D_sample_status@4
_AIL_3D_sample_volume@4
_AIL_auto_update_3D_position@8
_AIL_sample_status@4

dinput8

DirectInput8Create

libconfig++

??ASetting@libconfig@@QBEAAV01@PBD@Z
?lookupValue@Setting@libconfig@@QBE_NPBDAA_J@Z
?lookupValue@Setting@libconfig@@QBE_NPBDAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?add@Setting@libconfig@@QAEAAV12@PBDW4Type@12@@Z
??ASetting@libconfig@@QBEAAV01@H@Z
??0Config@libconfig@@QAE@XZ
??1Config@libconfig@@UAE@XZ
?getRoot@Config@libconfig@@QBEAAVSetting@2@XZ
?getLength@Setting@libconfig@@QBEHXZ
?getPath@SettingException@libconfig@@QBEPBDXZ
?add@Setting@libconfig@@QAEAAV12@W4Type@12@@Z
??4Setting@libconfig@@QAEAAV01@AB_J@Z
??4Setting@libconfig@@QAEAAV01@PBD@Z
??4Setting@libconfig@@QAEAAV01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?writeFile@Config@libconfig@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?readFile@Config@libconfig@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?add@Setting@libconfig@@QAEAAV12@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4Type@12@@Z

crypt32

PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringW
CryptQueryObject
CertCreateCertificateChainEngine
CryptStringToBinaryW
CertGetCertificateContextProperty
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertGetCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateChain

shell32

SHGetSpecialFolderPathA

api-ms-win-core-path-l1-1-0

PathCchCombineEx
PathCchSkipRoot
PathCchCanonicalizeEx

bcrypt

BCryptGenRandom

Exports

Exports

AmdPowerXpressRequestHighPerformance
NvOptimusEnablement

Sections

.text
Size: 6.7MB - Virtual size: 6.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 306KB - Virtual size: 966KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PyRuntim
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 340KB - Virtual size: 339KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c5a0eeff38b57770bf3ae84ada8b099d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

winmm

d3d8

version

ws2_32

imm32

rpcrt4

libcef

devil

mss32

dinput8

libconfig++

crypt32

shell32

api-ms-win-core-path-l1-1-0

bcrypt

Exports

Exports

Sections

.text Size: 6.7MB - Virtual size: 6.7MB

.rdata Size: 2.6MB - Virtual size: 2.6MB

.data Size: 306KB - Virtual size: 966KB

.data1 Size: 2KB - Virtual size: 2KB

PyRuntim Size: 512B - Virtual size: 360B

.rsrc Size: 45KB - Virtual size: 44KB

.reloc Size: 340KB - Virtual size: 339KB

.text
Size: 6.7MB - Virtual size: 6.7MB

.rdata
Size: 2.6MB - Virtual size: 2.6MB

.data
Size: 306KB - Virtual size: 966KB

.data1
Size: 2KB - Virtual size: 2KB

PyRuntim
Size: 512B - Virtual size: 360B

.rsrc
Size: 45KB - Virtual size: 44KB

.reloc
Size: 340KB - Virtual size: 339KB