f203909c6efc797a09397b4859f5a69ed4debcf462dfc10e7d5eb522c2875fce

Sharing

Copy URL Twitter E-mail

General

Target

f203909c6efc797a09397b4859f5a69ed4debcf462dfc10e7d5eb522c2875fce
Size

4.7MB
MD5

b0aea56ec79147533a03cd70c6065fc5
SHA1

6d0c3a7c9c289da40994738abafa081977cf0cdb
SHA256

f203909c6efc797a09397b4859f5a69ed4debcf462dfc10e7d5eb522c2875fce
SHA512

c4645acfb735bc792d7f81e5ffa99716e5ae7ddf78abfa5d11225ceac1bb85a063fcd7fcd4eac05348028421543fe73a53e9a9a07a7951dfe1fab701e306cd4e
SSDEEP

49152:VGliOfII02+sevSSfnFK90UAtpbMyiXfC27jVivYgyLsmGWntCH+Ja0SwYE/MnBl:/8w3b0cHmSpKqxbq+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f203909c6efc797a09397b4859f5a69ed4debcf462dfc10e7d5eb522c2875fce

Files

f203909c6efc797a09397b4859f5a69ed4debcf462dfc10e7d5eb522c2875fce
.dll windows:6 windows x64

611042fcac39ced87891533b9a950de2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

vmprotectsdk64

VMProtectFreeString
VMProtectBeginMutation
VMProtectDecryptStringA
VMProtectBeginUltra
VMProtectEnd

ws2_32

bind
WSAStartup
WSACleanup
freeaddrinfo
closesocket
WSAGetLastError
getsockopt
recv
WSARecv
listen
WSASend
getsockname
send
accept
select
connect
getaddrinfo
WSASocketW
getpeername
ioctlsocket
setsockopt

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
SystemFunction036

ntdll

RtlCaptureContext
RtlVirtualUnwind
NtWriteFile
RtlNtStatusToDosError
RtlLookupFunctionEntry

bcrypt

BCryptGenRandom

vulkan-1

vkDestroyImage
vkDestroyImageView
vkGetBufferMemoryRequirements
vkDestroyShaderModule
vkDestroyPipeline
vkBindBufferMemory
vkFlushMappedMemoryRanges
vkUnmapMemory
vkDestroyPipelineLayout
vkMapMemory
vkFreeMemory
vkDestroySampler
vkAllocateMemory
vkDestroyDescriptorSetLayout
vkCmdBindPipeline
vkCmdSetViewport
vkCmdSetScissor
vkCmdBindDescriptorSets
vkCmdBindIndexBuffer
vkGetPhysicalDeviceMemoryProperties
vkCmdBindVertexBuffers
vkGetDeviceQueue
vkGetPhysicalDeviceQueueFamilyProperties
vkCmdDrawIndexed
vkDestroyBuffer
vkCreateBuffer
vkCmdPushConstants

kernel32

GetSystemDirectoryW
CreateNamedPipeW
GetFullPathNameW
GetModuleFileNameW
FormatMessageW
CreateProcessW
GetFileAttributesW
WriteConsoleW
TlsGetValue
TlsSetValue
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetWindowsDirectoryW
InitializeSListHead
RaiseException
CreateFileW
CreateMutexA
WaitForSingleObjectEx
AcquireSRWLockShared
GetProcessHeap
SleepConditionVariableSRW
WakeAllConditionVariable
TerminateProcess
GetExitCodeProcess
WaitForSingleObject
ReadFileEx
SleepEx
WriteFileEx
SetHandleInformation
DuplicateHandle
GetEnvironmentVariableW
GetEnvironmentStringsW
GetCurrentDirectoryW
SetLastError
GetCurrentThread
SetThreadStackGuarantee
CompareStringOrdinal
ReleaseSRWLockShared
ReleaseMutex
FreeEnvironmentStringsW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
WriteConsoleA
GetConsoleMode
WriteFile
GetStdHandle
GetDynamicTimeZoneInformation
GetFileAttributesA
VirtualQuery
VirtualFree
K32EnumProcessModules
GetCurrentProcess
GetProcAddress
Sleep
DisableThreadLibraryCalls
CreateThread
CloseHandle
GetModuleHandleA
LoadLibraryA
GetModuleHandleExA
GetLastError
GetModuleFileNameA
GetSystemDirectoryA
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
FreeLibrary
HeapCreate
HeapAlloc
HeapReAlloc
HeapFree
GetCurrentProcessId
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
GetModuleHandleW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetSystemInfo
VirtualAlloc

user32

LoadCursorA
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
GetClientRect
GetForegroundWindow
SetCursorPos
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
GetAsyncKeyState
GetKeyState

msvcp140

?_Syserror_map@std@@YAPEBDH@Z
_Cnd_signal
_Cnd_destroy_in_situ
_Thrd_id
_Thrd_join
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_unlock
_Mtx_lock
_Xtime_get_ticks
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??Bid@locale@std@@QEAA_KXZ
?id@?$numpunct@D@std@@2V0locale@2@A
?_Xbad_alloc@std@@YAXXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
_Query_perf_counter
_Query_perf_frequency
_Mtx_destroy_in_situ
_Mtx_init_in_situ
?_Incref@facet@locale@std@@UEAAXXZ
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ

imm32

ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext
ImmReleaseContext

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp
_CxxThrowException
__CxxFrameHandler3
__C_specific_handler
__current_exception
memmove
__std_type_info_destroy_list
__C_specific_handler_noexcept
__vcrt_GetModuleFileNameW
__vcrt_LoadLibraryExW
memcpy
_purecall
__std_terminate
memset
__current_exception_context
__std_exception_copy
memchr
strstr
__std_exception_destroy

api-ms-win-crt-heap-l1-1-0

malloc
free
calloc
_callnewh

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_errno
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
terminate
_invalid_parameter_noinfo_noreturn
_register_onexit_function

api-ms-win-crt-convert-l1-1-0

atof
mbstowcs
strtoll
strtol
strtod

api-ms-win-crt-stdio-l1-1-0

fputs
_fsopen
__stdio_common_vsscanf
__stdio_common_vsprintf
fwrite
fflush
_wfopen
fread
fseek
__stdio_common_vsprintf_s
__acrt_iob_func
__stdio_common_vfprintf
ftell
_wfopen_s
fclose

api-ms-win-crt-string-l1-1-0

strcat_s
toupper
isdigit
strncmp
strncpy
strcmp
strlen
strcpy_s

api-ms-win-crt-math-l1-1-0

cosf
ceilf
acosf
sqrtf
fmodf
logf
_dsign
_fdsign
pow
powf
log
_ldsign
_dclass
_fdclass
sinf
_ldclass
log2f

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s
strftime
_gmtime64_s

api-ms-win-crt-filesystem-l1-1-0

_mkdir

Exports

Exports

CreateDXGIFactory
CreateDXGIFactory1
CreateDXGIFactory2
DESCRIPTION
DXGIDeclareAdapterRemovalSupport
DXGIGetDebugInterface1
GetFileVersionInfoA
GetFileVersionInfoExA
GetFileVersionInfoExW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeExA
GetFileVersionInfoSizeExW
GetFileVersionInfoSizeW
GetFileVersionInfoW
NAME
VerFindFileA
VerFindFileW
VerInstallFileA
VerInstallFileW
VerLanguageNameA
VerLanguageNameW
VerQueryValueA
VerQueryValueW

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 154KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

611042fcac39ced87891533b9a950de2

Headers

DLL Characteristics

File Characteristics

Imports

vmprotectsdk64

ws2_32

advapi32

ntdll

bcrypt

vulkan-1

kernel32

user32

msvcp140

imm32

d3dcompiler_47

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

Exports

Exports

Sections

.text Size: 3.0MB - Virtual size: 3.0MB

.rdata Size: 1.5MB - Virtual size: 1.5MB

.data Size: 17KB - Virtual size: 24KB

.pdata Size: 154KB - Virtual size: 153KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 20KB - Virtual size: 20KB

.text
Size: 3.0MB - Virtual size: 3.0MB

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 17KB - Virtual size: 24KB

.pdata
Size: 154KB - Virtual size: 153KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 20KB - Virtual size: 20KB