iw5sp[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

iw5sp.exe
Size

5.4MB
MD5

496727fc020a94ba53d8508832c263c6
SHA1

d36cd4b89296da35c7a0f376e75a9f6ada1614a1
SHA256

91948eeeab3338f8855f8d03d26f9f0e934cbcd7f21d26b80211ed4c7d650397
SHA512

51fb3f8d6581ea5d289d2c7331a4e7673f806b0da20a16658278a32dc848b1eb123295d8e16e2091f1d280f1670a1fc1fc5d555a284ba62d35a79a31aef07882
SSDEEP

98304:3mj2Ke5bNIHD2U0XZl+aDMchZqw8ENIShAuUYbiKWPR6IIIII1iougxRFsbtzwxY:WCpNIHD2U0XZxQ238ENIShAuUSirP4IY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
iw5sp.exe

Files

iw5sp.exe
.exe windows:5 windows x86

11c7d03b601a177af35b4679c94501dd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

steam_api

SteamAPI_RegisterCallback
SteamAPI_RunCallbacks
SteamUserStats
SteamAPI_Init
SteamAPI_UnregisterCallback
SteamAPI_UnregisterCallResult
SteamAPI_RegisterCallResult
SteamAPI_Shutdown
SteamUser
SteamRemoteStorage
SteamNetworking
SteamApps
SteamAPI_RestartAppIfNecessary
SteamFriends
SteamUtils
SteamMatchmaking

mss32

_AIL_set_preference@8
_AIL_open_digital_driver@16
_AIL_speaker_configuration@20
_AIL_stream_status@4
_AIL_sample_status@4
_AIL_sample_3D_position@16
_AIL_sample_volume_pan@12
_AIL_sample_ms_position@12
_AIL_set_sample_volume_levels@12
_AIL_sample_volume_levels@12
_AIL_set_room_type@8
_AIL_open_stream@12
_AIL_stream_ms_position@12
_AIL_sample_playback_rate@4
_AIL_set_sample_playback_rate@8
_AIL_set_stream_loop_count@8
_AIL_set_sample_reverb_levels@12
_AIL_set_stream_ms_position@8
_AIL_stream_info@20
_AIL_set_sample_3D_distances@16
_AIL_set_speaker_configuration@16
_AIL_set_sample_channel_levels@12
_AIL_pause_stream@8
_AIL_close_stream@4
_AIL_resume_sample@4
_AIL_stop_sample@4
_AIL_end_sample@4
_AIL_stream_sample_handle@4
_AIL_set_sample_3D_position@16
_AIL_digital_CPU_percent@4
_AIL_shutdown@0
_AIL_startup@0
_AIL_set_sample_processor@12
_AIL_sample_processor@8
_AIL_sample_stage_property@24
_AIL_find_filter@8
_AIL_open_filter@8
_AIL_set_3D_distance_factor@8
_AIL_set_redist_directory@4
_AIL_allocate_sample_handle@4
_AIL_init_sample@12
_AIL_set_DirectSound_HWND@8
_AIL_sample_channel_levels@8
_AIL_set_3D_rolloff_factor@8
_AIL_size_processed_digital_audio@16
_AIL_process_digital_audio@24
_AIL_set_sample_info@8
_AIL_set_sample_loop_count@8
_AIL_set_sample_ms_position@8
_AIL_set_file_callbacks@16

binkw32

_BinkOpen@8
_BinkGetError@0
_BinkSetIOSize@4
_BinkSetError@4
_BinkClose@4
_BinkPause@8
_BinkWait@4
_BinkDoFrame@4
_BinkGoto@12
_BinkNextFrame@4
_BinkGetRealtime@12
_BinkControlBackgroundIO@8
_BinkGetRects@8
_BinkSetMixBinVolumes@20
_BinkGetKeyFrame@12
_BinkRegisterFrameBuffers@8
_BinkGetFrameBuffersInfo@8
_BinkSetSoundTrack@8
_BinkSetSoundSystem@8
_BinkOpenMiles@4
_BinkSetMemory@8

d3d9

Direct3DCreate9

powrprof

CallNtPowerInformation

ws2_32

connect
ntohl
gethostname
bind
socket
closesocket
select
__WSAFDIsSet
recvfrom
htonl
send
htons
inet_addr
gethostbyname
WSAGetLastError
ntohs
shutdown
recv
ioctlsocket
inet_ntoa
sendto
setsockopt
WSACleanup
WSAStartup
getsockname
getsockopt
WSASetLastError

winmm

timeBeginPeriod
timeGetTime
timeEndPeriod

kernel32

GetConsoleOutputCP
WriteConsoleA
SetEndOfFile
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
FlushFileBuffers
WriteConsoleW
GetConsoleMode
GetConsoleCP
DeleteCriticalSection
SetHandleCount
SetFilePointer
GetFileType
PeekNamedPipe
GetStdHandle
LCMapStringW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
GetCommandLineA
HeapReAlloc
GetModuleHandleW
CreateDirectoryA
RtlUnwind
GetDriveTypeA
FileTimeToLocalFileTime
MoveFileA
ReleaseMutex
CreateMutexA
CompareStringA
CompareStringW
SetEnvironmentVariableA
WaitForMultipleObjects
GetExitCodeThread
TerminateThread
ExpandEnvironmentStringsA
GetVersion
FlushConsoleInputBuffer
ExitThread
ReadConsoleInputA
SetConsoleMode
HeapCreate
OpenEventA
OpenFileMappingA
GetSystemDirectoryW
GetWindowsDirectoryW
GetModuleFileNameW
LoadLibraryA
FreeLibrary
GlobalMemoryStatusEx
FindNextFileA
FindFirstFileA
GetCurrentProcess
InterlockedDecrement
InterlockedExchange
LeaveCriticalSection
AddVectoredExceptionHandler
GetProcessHeap
lstrlenW
EnterCriticalSection
GetFileInformationByHandle
HeapAlloc
GetLastError
InterlockedIncrement
HeapFree
InterlockedExchangeAdd
CreateFileA
CreateEventA
InterlockedCompareExchange
MapViewOfFile
SetLastError
lstrcmpiW
GetModuleHandleA
GetCurrentThreadId
SetPriorityClass
CloseHandle
CreateFileW
CreateSemaphoreA
VirtualQuery
GetCurrentDirectoryW
GetFullPathNameA
VirtualAlloc
GetStartupInfoW
InitializeCriticalSection
GetFullPathNameW
CreateFileMappingA
UnmapViewOfFile
GetEnvironmentStringsW
WriteFile
SizeofResource
HeapSize
GetComputerNameA
GetModuleHandleExA
ReleaseSemaphore
GetTimeZoneInformation
SetEvent
RemoveVectoredExceptionHandler
GetTickCount
LockResource
GetProcessTimes
SetThreadExecutionState
FindResourceW
GetCommandLineW
ExitProcess
GetSystemTime
LoadResource
FileTimeToSystemTime
GetFileTime
GetConsoleWindow
GetModuleFileNameA
GetCurrentProcessId
WaitForSingleObject
GetSystemTimeAsFileTime
GetProcAddress
GetFileSize
ReadFileEx
SleepEx
Sleep
ResetEvent
GetProcessAffinityMask
DuplicateHandle
GetCurrentThread
SetThreadPriority
RaiseException
CreateThread
SuspendThread
ResumeThread
SetThreadAffinityMask
GetThreadPriority
VirtualFree
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalMemoryStatus
GetSystemInfo
GetVersionExA
SetProcessAffinityMask
FormatMessageA
GlobalUnlock
GlobalSize
GlobalLock
Module32Next
Module32First
CreateToolhelp32Snapshot
OpenProcess
ReadFile
DeleteFileA
SetErrorMode
SystemTimeToFileTime
MulDiv
GetCurrentDirectoryA
FindClose

user32

GetProcessWindowStation
CloseWindow
IsWindow
AdjustWindowRectEx
EnumDisplayMonitors
MonitorFromPoint
RegisterWindowMessageA
MonitorFromWindow
ShowWindow
DestroyWindow
DefWindowProcA
GetForegroundWindow
MessageBoxA
SystemParametersInfoA
ClipCursor
ClientToScreen
GetClientRect
GetWindowRect
SetWindowLongA
GetWindowLongA
GetWindowTextA
ReleaseDC
GetDC
GetDesktopWindow
EnumThreadWindows
ChangeDisplaySettingsA
GetSystemMetrics
SetCursorPos
SetFocus
ScreenToClient
GetCursorPos
ShowCursor
PostMessageA
DispatchMessageA
TranslateMessage
GetMessageA
CloseClipboard
GetClipboardData
OpenClipboard
PeekMessageA
RegisterClassExA
LoadCursorA
LoadIconA
GetActiveWindow
SetWindowPos
AdjustWindowRect
SendMessageA
CreateWindowExA
LoadImageA
RegisterClassA
UpdateWindow
PostQuitMessage
CallWindowProcA
SetWindowTextA
GetUserObjectInformationW
MapVirtualKeyA
MoveWindow
GetMonitorInfoA

gdi32

GetBitmapBits
DeleteObject
DeleteDC
BitBlt
GetObjectA
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCA
GetDeviceCaps
CreateFontA
SelectObject
SetDeviceGammaRamp
CreateSolidBrush

advapi32

RegOpenKeyExA
RegQueryInfoKeyA
RegQueryValueExA
CryptReleaseContext
CryptAcquireContextA
CryptGenRandom
InitializeSecurityDescriptor
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegEnumKeyExA
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
SetSecurityDescriptorDacl

shell32

ShellExecuteA

ole32

StringFromGUID2

Sections

.text
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 145KB - Virtual size: 31.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 33B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.version
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

11c7d03b601a177af35b4679c94501dd

Headers

DLL Characteristics

File Characteristics

Imports

steam_api

mss32

binkw32

d3d9

powrprof

ws2_32

winmm

kernel32

user32

gdi32

advapi32

shell32

ole32

Sections

.text Size: 3.9MB - Virtual size: 3.9MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 145KB - Virtual size: 31.0MB

.tls Size: 512B - Virtual size: 33B

.version Size: 512B - Virtual size: 4B

.rsrc Size: 93KB - Virtual size: 93KB

.text
Size: 3.9MB - Virtual size: 3.9MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 145KB - Virtual size: 31.0MB

.tls
Size: 512B - Virtual size: 33B

.version
Size: 512B - Virtual size: 4B

.rsrc
Size: 93KB - Virtual size: 93KB