2cd2cc848ef953cac3dedcfca437c6564487d772cdd35964048c528bc150841b

Sharing

Copy URL Twitter E-mail

General

Target

2cd2cc848ef953cac3dedcfca437c6564487d772cdd35964048c528bc150841b
Size

3.1MB
MD5

7fb425ef102020a83e5c1df72b08116c
SHA1

937824dff478e07111bcee480ee919a4c017fa4e
SHA256

2cd2cc848ef953cac3dedcfca437c6564487d772cdd35964048c528bc150841b
SHA512

5dfd70eb46454720a2c885e5046626d246d9d39ccf62a1ab2c60cccff2da925423a633951e6e9b5deb351016e0c84b28c1a063838071c08659a25d46ab0f778a
SSDEEP

49152:Su1kxj+cJBd7SVRAcbGA2wr/a0v30Qfs1wU/z9PlC9G+MfwKaXldmS:Su1kxFJBd7xU5ULC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2cd2cc848ef953cac3dedcfca437c6564487d772cdd35964048c528bc150841b

Files

2cd2cc848ef953cac3dedcfca437c6564487d772cdd35964048c528bc150841b
.dll windows:6 windows x86

86a1c91ba2f3711cfaefb889c6d0bb5e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
ReadProcessMemory
SetDllDirectoryA
Sleep
WaitForSingleObject
GetFinalPathNameByHandleA
GetCurrentThread
CreateFileW
BeginUpdateResourceW
UpdateResourceA
UpdateResourceW
EndUpdateResourceA
CreateProcessW
GetModuleHandleA
TerminateProcess
OpenProcess
LocalFree
CreateThread
SetEvent
GetCurrentProcess
VirtualProtect
GetCommandLineA
VirtualQueryEx
WriteProcessMemory
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ExitProcess
GetCurrentThreadId
FormatMessageA
GetCurrentProcessId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
QueryPerformanceCounter
QueryPerformanceFrequency
GetProcAddress
LoadLibraryW
GetSystemDirectoryW
CreateProcessA
FindClose
OutputDebugStringW
OutputDebugStringA
GetSystemTime
WideCharToMultiByte
MultiByteToWideChar
OpenEventA
ResetEvent
GetLastError
LoadLibraryA
GetModuleFileNameA
UnmapViewOfFile
OpenFileMappingA
MapViewOfFile
WriteFile
CloseHandle
ReadFile
ReadConsoleA
SetConsoleMode
ConvertThreadToFiberEx
ConvertFiberToThread
GetSystemDirectoryA
FindFirstFileW
CreateFiberEx
DeleteFiber
SwitchToFiber
AcquireSRWLockShared
ReleaseSRWLockShared
SystemTimeToFileTime
SetEndOfFile
WriteConsoleW
HeapSize
GetFileSize
GetLocalTime
GetProcessHeap
SetEnvironmentVariableW
RaiseException
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
WaitForSingleObjectEx
GetExitCodeThread
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
VirtualProtectEx
SetLastError
VirtualAllocEx
ResumeThread
GetEnvironmentVariableW
LoadLibraryExW
LoadLibraryExA
VirtualQuery
InterlockedCompareExchange
FlushInstructionCache
SetThreadContext
GetThreadContext
VirtualFree
SuspendThread
VirtualAlloc
RtlUnwind
InterlockedFlushSList
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetTimeZoneInformation
GetModuleFileNameW
GetFullPathNameW
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
HeapFree
HeapAlloc
GetStdHandle
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetCurrentDirectoryW
SetStdHandle
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
DeleteFileW
HeapReAlloc
SetConsoleCtrlHandler
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW

user32

MessageBoxA
GetUserObjectInformationW
MessageBoxW
wsprintfA
GetProcessWindowStation

advapi32

CryptSignHashW
RegQueryValueExA
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
RegOpenKeyExA
CryptEnumProvidersW
RegCloseKey
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegOpenKeyA

shell32

CommandLineToArgvW

ws2_32

listen
htons
select
getaddrinfo
freeaddrinfo
htonl
getsockopt
getsockname
ioctlsocket
connect
ntohs
inet_pton
socket
WSAGetLastError
setsockopt
send
recv
closesocket
WSACleanup
WSAStartup
WSASetLastError
inet_addr
inet_ntoa
gethostbyaddr
gethostbyname
getservbyport
getservbyname
shutdown
inet_ntop
getpeername
recvfrom
sendto
accept
WSAPoll
bind

bcrypt

BCryptGenRandom

crypt32

CertCloseStore
CertGetCertificateContextProperty
CertFreeCertificateContext
CertOpenStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext

Exports

Exports

DetourFinishHelperProcess
GetFileVersionInfoA
GetFileVersionInfoByHandle
GetFileVersionInfoExW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeExW
GetFileVersionInfoSizeW
GetFileVersionInfoW
OpenAPI_LoadLibrary
SetInOfflineMode
SteamAPI_RegisterCallResult
SteamAPI_RegisterCallback
SteamAPI_UnregisterCallResult
SteamAPI_UnregisterCallback
SteamInternal_CreateInterface
Steam_BGetCallback
Steam_FreeLastCallback
Steam_GetAPICallResult
Steam_ReleaseThreadLocalMemory
Steam_RunCallbacks
VerFindFileA
VerFindFileW
VerInstallFileA
VerInstallFileW
VerLanguageNameA
VerLanguageNameW
VerQueryValueA
VerQueryValueW
_SundaySearch@12
changeIcon
hookSteamLoginAddr
steamReflash

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 635KB - Virtual size: 635KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 37KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

86a1c91ba2f3711cfaefb889c6d0bb5e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ws2_32

bcrypt

crypt32

Exports

Exports

Sections

.text Size: 2.4MB - Virtual size: 2.4MB

.rdata Size: 635KB - Virtual size: 635KB

.data Size: 37KB - Virtual size: 52KB

.rsrc Size: 1024B - Virtual size: 984B

.reloc Size: 111KB - Virtual size: 110KB

.text
Size: 2.4MB - Virtual size: 2.4MB

.rdata
Size: 635KB - Virtual size: 635KB

.data
Size: 37KB - Virtual size: 52KB

.rsrc
Size: 1024B - Virtual size: 984B

.reloc
Size: 111KB - Virtual size: 110KB