10d4cfd76700a91c69a532a5f882ed64c7f61a23af286ad1261891d6809db611

Sharing

Copy URL Twitter E-mail

General

Target

10d4cfd76700a91c69a532a5f882ed64c7f61a23af286ad1261891d6809db611
Size

10.0MB
MD5

d833f5c65b6a425dd9d302b10bff73c5
SHA1

1ad2a49cb628d30992a9b507b6acaff074ce62b9
SHA256

10d4cfd76700a91c69a532a5f882ed64c7f61a23af286ad1261891d6809db611
SHA512

cf2b1cd131d8a512520d323c887a57235344f1df05000886c67a1db4e0c4201a91d38e06a809d383a439bee3ad18dc9fe8931fcea84921c37d3a32fe45a9bbbb
SSDEEP

98304:MxKWU6Y2nJ51kXC2NGm7x9IUnxrsA5O1gNubm424QfduoHuVM3vuR4cVBj:jAJ5SXC2PIU9sA5O1RbiQ2lcR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
10d4cfd76700a91c69a532a5f882ed64c7f61a23af286ad1261891d6809db611

Files

10d4cfd76700a91c69a532a5f882ed64c7f61a23af286ad1261891d6809db611
.exe windows:6 windows x86

802145fb813e13a735fb7bad4df6bdfa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SwitchToThread
GetExitCodeThread
GetNativeSystemInfo
CreateThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetDiskFreeSpaceExW
GetFileAttributesW
GetFileAttributesExW
IsDebuggerPresent
GetDynamicTimeZoneInformation
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFullPathNameW
SetFileAttributesW
SetFileTime
DeviceIoControl
GetModuleHandleW
MoveFileExW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
QueryPerformanceFrequency
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
EncodePointer
DecodePointer
InitializeCriticalSectionEx
LCMapStringEx
LocalFree
GetTickCount64
VerifyVersionInfoA
CreateWaitableTimerA
TlsSetValue
TlsGetValue
TerminateThread
QueueUserAPC
WaitForMultipleObjects
SetWaitableTimer
CreateEventW
SleepEx
WaitForSingleObjectEx
CancelIoEx
GetQueuedCompletionStatus
CreateIoCompletionPort
RaiseException
SetLastError
QueryPerformanceCounter
CreateSemaphoreA
ReleaseSemaphore
TlsAlloc
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeSRWLock
PostQueuedCompletionStatus
TlsFree
CreateToolhelp32Snapshot
GetCurrentProcessId
Module32First
CloseHandle
Module32Next
GetCurrentProcess
ReadProcessMemory
GetSystemInfo
Process32First
OpenProcess
Sleep
Process32Next
SetEvent
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSection
CreateEventA
SetFileAttributesA
FindFirstFileA
FindNextFileA
FindClose
GetLocalTime
VerSetConditionMask
VerifyVersionInfoW
CreateDirectoryA
HeapAlloc
GetProcessHeap
HeapFree
GetModuleFileNameA
CreateFileA
GetFileSize
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
OutputDebugStringA
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetFileAttributesA
GetStdHandle
SetFilePointerEx
GetFileSizeEx
CreateFileW
WriteFile
SetFilePointer
ReadFile
InitializeCriticalSectionAndSpinCount
FormatMessageA
AllocConsole
SetUnhandledExceptionFilter
GetCurrentThreadId
GetProcAddress
LoadLibraryA
GetSystemTimeAsFileTime
PeekConsoleInputA
ReadConsoleInputW
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapCompact
UnlockFileEx
LockFileEx
FlushFileBuffers
SetStdHandle
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
SetConsoleCtrlHandler
InterlockedPushEntrySList
RtlUnwind
GetSystemDirectoryW
ResumeThread
GetModuleHandleExA
GetProcessAffinityMask
lstrcmpA
GetEnvironmentVariableA
CreateThread
GetTickCount
WaitNamedPipeA
CreateNamedPipeA
OpenFileMappingW
CreateFileMappingW
VirtualQuery
GetVersion
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
InitializeProcThreadAttributeList
CreateProcessW
GetExitCodeProcess
ExitProcess
CancelIo
GetOverlappedResult
SetNamedPipeHandleState
ConnectNamedPipe
ExpandEnvironmentStringsW
FlushViewOfFile
DuplicateHandle
SetEndOfFile
GetErrorMode
GetTimeZoneInformation
LoadLibraryExW
WriteConsoleW
GetNumberOfConsoleInputEvents
ResetEvent
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
SetErrorMode
GenerateConsoleCtrlEvent
GetActiveProcessorCount
LoadLibraryW
GetProcessTimes
CreatePipe
RemoveDirectoryW
GetVolumePathNameW
DeleteFileW
SetEnvironmentVariableW
GetSystemTimeAdjustment
GetConsoleOutputCP
GetConsoleCP
SetHandleInformation
GetHandleInformation
GetVersionExW
OutputDebugStringW
FormatMessageW
WaitNamedPipeW
PeekNamedPipe
GetModuleFileNameW
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetACP
GetFileType
GetEnvironmentVariableW
VirtualFree
VirtualProtect
VirtualAlloc
AcquireSRWLockShared
ReleaseSRWLockShared
GetThreadTimes
GetCurrentThread
TerminateProcess
GetStartupInfoW
UnhandledExceptionFilter
InitializeSListHead
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
GlobalLock
GlobalUnlock
FreeLibrary
GetVersionExA
GetSystemDirectoryA
GetModuleHandleA
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
WriteConsoleA
GetConsoleMode
IsProcessorFeaturePresent
HeapValidate
GetCPInfo
GetStringTypeW
GetLocaleInfoEx

user32

GetUserObjectInformationW
GetKeyState
GetCursorPos
ScreenToClient
GetCursorInfo
GetIconInfo
DrawIconEx
CharPrevExA
CharNextExA
CharNextW
GetClipboardData
CloseClipboard
OpenClipboard
FindWindowA
GetKeyboardLayout
GetKeyboardLayoutNameA
LoadCursorA
SetWindowLongA
GetWindowLongA
SetRect
AdjustWindowRectEx
GetWindowRect
InvalidateRect
GetMenu
RegisterClassA
ReleaseDC
GetDC
PostQuitMessage
PeekMessageA
DispatchMessageA
TranslateMessage
GetMessageA
MessageBoxA
GetClientRect
UpdateWindow
SetFocus
MoveWindow
DestroyWindow
IsWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
DefWindowProcA
MessageBoxW
GetSystemMetrics
GetCapture
ShowWindow
ChangeDisplaySettingsA
ReleaseCapture
SetCapture
SetCursorPos
ClientToScreen
SetCursor
ShowCursor
DestroyCursor
LoadImageA
FlashWindowEx
SystemParametersInfoA
SetWindowPos
LoadIconA
GetProcessWindowStation

gdi32

GetTextExtentPoint32A
GetDIBits
CreateCompatibleBitmap
BitBlt
TextOutA
CreateDIBSection
SetBkMode
DeleteDC
CreateCompatibleDC
TextOutW
SetTextColor
SetBkColor
SelectObject
GetTextExtentPoint32W
GetCharABCWidthsFloatW
DeleteObject
CreateFontIndirectA
EnumFontFamiliesExA
GetStockObject

advapi32

CryptEnumProvidersW
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptEncrypt
CryptImportKey
CryptHashData
CryptGetHashParam
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
RegSetValueW
RegSaveKeyW
RegQueryValueW
RegQueryInfoKeyW
RegLoadKeyW
RegFlushKey
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyExW
RegDeleteKeyW
RegCreateKeyW
RegConnectRegistryW
CryptGenRandom
GetUserNameW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegCloseKey
CryptSignHashW
CryptDestroyHash
CryptCreateHash

ole32

CoUninitialize
CoInitializeEx
CoCreateInstance

oleaut32

VariantClear
SysFreeString

winmm

timeBeginPeriod
timeGetDevCaps
timeGetTime
timeEndPeriod

d3d8

Direct3DCreate8

version

GetFileVersionInfoSizeA
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoA
VerQueryValueA

ws2_32

WSARecv
WSASocketW
WSAStringToAddressW
WSAIoctl
freeaddrinfo
socket
send
bind
WSASetLastError
listen
getsockopt
getaddrinfo
getsockname
select
recv
connect
accept
WSASend
ioctlsocket
closesocket
WSAGetLastError
setsockopt
getpeername
sendto
recvfrom
inet_pton
inet_ntop
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
shutdown
getservbyname
getservbyport
gethostbyaddr
inet_ntoa
gethostname
gethostbyname
ntohs
WSACleanup
ntohl
inet_addr
__WSAFDIsSet
htons
WSAStartup
htonl

imm32

ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
ImmNotifyIME

rpcrt4

UuidCreateSequential

libcef

cef_string_utf8_clear
cef_string_utf16_clear
cef_string_multimap_free
cef_string_multimap_alloc
cef_log
cef_string_multimap_append
cef_string_multimap_value
cef_string_multimap_key
cef_string_multimap_size
cef_string_map_append
cef_string_map_value
cef_string_map_key
cef_string_map_size
cef_string_list_append
cef_string_list_value
cef_string_list_size
cef_v8context_get_current_context
cef_string_utf8_to_utf16
cef_run_message_loop
cef_shutdown
cef_initialize
cef_execute_process
cef_register_extension
cef_browser_host_create_browser
cef_api_hash
cef_command_line_get_global
cef_string_map_free
cef_string_map_alloc
cef_string_list_free
cef_string_list_alloc
cef_string_userfree_utf16_free
cef_string_utf16_set
cef_string_utf16_cmp
cef_string_utf16_to_utf8

devil

ilTexImage
ilSave
ilShutDown
ilDeleteImages
ilCopyPixels
ilInit
ilGetInteger
ilLoad
ilOriginFunc
ilSetPixels
ilBindImage
ilGenImages
ilConvertImage
ilEnable

mss32

_AIL_mem_free_lock@4
_AIL_file_read@8
_AIL_set_file_callbacks@16
_AIL_WAV_info@8
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_last_error@0
_AIL_allocate_sample_handle@4
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_loop_count@8
_AIL_3D_sample_status@4
_AIL_3D_sample_volume@4
_AIL_auto_update_3D_position@8
_AIL_set_sample_loop_count@8

dinput8

DirectInput8Create

libconfig++

??ASetting@libconfig@@QBEAAV01@PBD@Z
?lookupValue@Setting@libconfig@@QBE_NPBDAA_J@Z
?lookupValue@Setting@libconfig@@QBE_NPBDAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?add@Setting@libconfig@@QAEAAV12@PBDW4Type@12@@Z
??ASetting@libconfig@@QBEAAV01@H@Z
??0Config@libconfig@@QAE@XZ
??1Config@libconfig@@UAE@XZ
?getRoot@Config@libconfig@@QBEAAVSetting@2@XZ
?getLength@Setting@libconfig@@QBEHXZ
?getPath@SettingException@libconfig@@QBEPBDXZ
?add@Setting@libconfig@@QAEAAV12@W4Type@12@@Z
??4Setting@libconfig@@QAEAAV01@AB_J@Z
??4Setting@libconfig@@QAEAAV01@PBD@Z
??4Setting@libconfig@@QAEAAV01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?writeFile@Config@libconfig@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?readFile@Config@libconfig@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?add@Setting@libconfig@@QAEAAV12@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4Type@12@@Z

crypt32

PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringW
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CryptStringToBinaryW
CertGetCertificateContextProperty
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFreeCertificateChain
CertGetCertificateChain

shell32

SHGetSpecialFolderPathA

api-ms-win-core-path-l1-1-0

PathCchCombineEx
PathCchSkipRoot
PathCchCanonicalizeEx

bcrypt

BCryptGenRandom

Exports

Exports

AmdPowerXpressRequestHighPerformance
NvOptimusEnablement

Sections

.text
Size: 6.7MB - Virtual size: 6.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 306KB - Virtual size: 966KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PyRuntim
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 340KB - Virtual size: 340KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

802145fb813e13a735fb7bad4df6bdfa

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

winmm

d3d8

version

ws2_32

imm32

rpcrt4

libcef

devil

mss32

dinput8

libconfig++

crypt32

shell32

api-ms-win-core-path-l1-1-0

bcrypt

Exports

Exports

Sections

.text Size: 6.7MB - Virtual size: 6.7MB

.rdata Size: 2.6MB - Virtual size: 2.6MB

.data Size: 306KB - Virtual size: 966KB

.data1 Size: 2KB - Virtual size: 2KB

PyRuntim Size: 512B - Virtual size: 360B

.rsrc Size: 45KB - Virtual size: 44KB

.reloc Size: 340KB - Virtual size: 340KB

.text
Size: 6.7MB - Virtual size: 6.7MB

.rdata
Size: 2.6MB - Virtual size: 2.6MB

.data
Size: 306KB - Virtual size: 966KB

.data1
Size: 2KB - Virtual size: 2KB

PyRuntim
Size: 512B - Virtual size: 360B

.rsrc
Size: 45KB - Virtual size: 44KB

.reloc
Size: 340KB - Virtual size: 340KB