7e3474f6808b075e00dcd7396262889e5f39ca90991408e9e3015e63323e53a8

Sharing

Copy URL Twitter E-mail

General

Target

7e3474f6808b075e00dcd7396262889e5f39ca90991408e9e3015e63323e53a8
Size

3.1MB
MD5

1eb441212e738547ea70bced8b6d39f7
SHA1

95072285929636268b8b4fe0f35bb02f2b0bcd04
SHA256

7e3474f6808b075e00dcd7396262889e5f39ca90991408e9e3015e63323e53a8
SHA512

e98c9c88c98ab40a451c4b0d18019544627b2abbaa71299ca37af128e5d74ae89b2be705905cd46a01ce8b481262be247a3674a60ace4cd3454cd537004379d9
SSDEEP

49152:HVty5xReveIYckolVIQb1Mg19MNK0/XzaOizAPia1WXmWmXnTH3JfIK:HVtGxIvLYc5VZ1sWOqaAX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7e3474f6808b075e00dcd7396262889e5f39ca90991408e9e3015e63323e53a8

Files

7e3474f6808b075e00dcd7396262889e5f39ca90991408e9e3015e63323e53a8
.dll windows:6 windows x86

abcbab583eceb1fb1ed25ba3001d9df4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
ReadProcessMemory
Sleep
GetFinalPathNameByHandleA
GetCurrentThread
CreateFileW
BeginUpdateResourceW
UpdateResourceA
UpdateResourceW
EndUpdateResourceA
CreateProcessW
GetModuleHandleA
TerminateProcess
OpenProcess
LocalFree
WaitForSingleObject
GetCurrentProcess
VirtualProtect
GetCommandLineA
VirtualQueryEx
WriteProcessMemory
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetLocalTime
ExitProcess
FormatMessageA
GetCurrentProcessId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
QueryPerformanceCounter
QueryPerformanceFrequency
GetProcAddress
LoadLibraryW
GetSystemDirectoryW
CreateProcessA
FindClose
OutputDebugStringW
OutputDebugStringA
GetSystemTime
WideCharToMultiByte
MultiByteToWideChar
OpenEventA
GetLastError
LoadLibraryA
GetModuleFileNameA
UnmapViewOfFile
OpenFileMappingA
MapViewOfFile
WriteFile
CloseHandle
ReadFile
ReadConsoleA
SetConsoleMode
ConvertThreadToFiberEx
ConvertFiberToThread
GetSystemDirectoryA
FindFirstFileW
CreateFiberEx
DeleteFiber
SwitchToFiber
AcquireSRWLockShared
ReleaseSRWLockShared
SystemTimeToFileTime
SetEndOfFile
WriteConsoleW
HeapSize
GetFileSize
GetCurrentThreadId
GetProcessHeap
SetEnvironmentVariableW
RaiseException
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
WaitForSingleObjectEx
GetExitCodeThread
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
CreateEventW
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
VirtualProtectEx
SetLastError
VirtualAllocEx
ResumeThread
GetEnvironmentVariableW
LoadLibraryExW
LoadLibraryExA
VirtualQuery
InterlockedCompareExchange
FlushInstructionCache
SetThreadContext
GetThreadContext
VirtualFree
SuspendThread
VirtualAlloc
RtlUnwind
InterlockedFlushSList
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetTimeZoneInformation
GetModuleFileNameW
GetFullPathNameW
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
HeapFree
HeapAlloc
GetStdHandle
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetCurrentDirectoryW
SetStdHandle
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
DeleteFileW
HeapReAlloc
SetConsoleCtrlHandler
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW

user32

MessageBoxA
GetUserObjectInformationW
MessageBoxW
wsprintfA
GetProcessWindowStation

advapi32

CryptSignHashW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptEnumProvidersW
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

shell32

CommandLineToArgvW

ws2_32

listen
htons
select
getaddrinfo
freeaddrinfo
htonl
getsockopt
getsockname
ioctlsocket
connect
ntohs
inet_pton
socket
WSAGetLastError
setsockopt
send
recv
closesocket
WSACleanup
WSAStartup
WSASetLastError
inet_addr
inet_ntoa
gethostbyaddr
gethostbyname
getservbyport
getservbyname
shutdown
inet_ntop
getpeername
recvfrom
sendto
accept
WSAPoll
bind

bcrypt

BCryptGenRandom

crypt32

CertCloseStore
CertGetCertificateContextProperty
CertFreeCertificateContext
CertOpenStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext

Exports

Exports

DetourFinishHelperProcess
GetFileVersionInfoA
GetFileVersionInfoByHandle
GetFileVersionInfoExW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeExW
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerFindFileA
VerFindFileW
VerInstallFileA
VerInstallFileW
VerLanguageNameA
VerLanguageNameW
VerQueryValueA
VerQueryValueW
_SundaySearch@12
changeIcon
hookSteamLoginAddr
steamReflash

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 629KB - Virtual size: 629KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

abcbab583eceb1fb1ed25ba3001d9df4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ws2_32

bcrypt

crypt32

Exports

Exports

Sections

.text Size: 2.3MB - Virtual size: 2.3MB

.rdata Size: 629KB - Virtual size: 629KB

.data Size: 36KB - Virtual size: 51KB

.rsrc Size: 1024B - Virtual size: 984B

.reloc Size: 109KB - Virtual size: 109KB

.text
Size: 2.3MB - Virtual size: 2.3MB

.rdata
Size: 629KB - Virtual size: 629KB

.data
Size: 36KB - Virtual size: 51KB

.rsrc
Size: 1024B - Virtual size: 984B

.reloc
Size: 109KB - Virtual size: 109KB