77c620183a97fb8f370413233b069a964abdbfa7562a07c992081e59da2a616c

Sharing

Copy URL Twitter E-mail

General

Target

77c620183a97fb8f370413233b069a964abdbfa7562a07c992081e59da2a616c
Size

1.9MB
MD5

e504f8bf65f92e49ed67d0a2fb82dc47
SHA1

6fcdc29ce2e177f498bfd7be09f029ef6c980d78
SHA256

77c620183a97fb8f370413233b069a964abdbfa7562a07c992081e59da2a616c
SHA512

3386f0d0729a1c2990c9e5b5a6e5d4eab604aafd39099107eb5aa7095db53ede5f2751c9a4eb70ee9879a14a3bcdda230ea8cfc7bfcabaf6a38a0f2e770369d0
SSDEEP

49152:LKj+Gse/ojaGzW98dztaPu4/PJ2CpUk5c:TGsxjaGzW987F

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
77c620183a97fb8f370413233b069a964abdbfa7562a07c992081e59da2a616c

Files

77c620183a97fb8f370413233b069a964abdbfa7562a07c992081e59da2a616c
.dll windows:6 windows x86

1d29605188d48c08f65bbf82f4503935

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

socket
inet_addr
listen
closesocket
htons
bind
ntohs
accept
freeaddrinfo
ioctlsocket
sendto
recvfrom
shutdown
gethostname
setsockopt
WSAIoctl
WSASetLastError
ntohl
htonl
getsockname
select
connect
getsockopt
send
recv
WSAGetLastError
WSAStartup
inet_ntoa
getaddrinfo
inet_ntop

kernel32

WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
Sleep
OutputDebugStringA
GetSystemTimeAsFileTime
CloseHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
GetCurrentThreadId
GetTickCount
GetSystemDirectoryA
FreeLibrary
GetProcAddress
LoadLibraryA
LocalAlloc
LocalFree
FormatMessageA
QueryPerformanceCounter
QueryPerformanceFrequency
GetLastError
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
ReleaseSemaphore
CreateSemaphoreA
GetStdHandle
GetFileType
HeapSize
GetModuleHandleA
MultiByteToWideChar
GetCurrentProcessId
GlobalMemoryStatus
FlushConsoleInputBuffer
DuplicateHandle
SetLastError
GetCurrentProcess
GetCurrentThread
SetThreadPriority
GetThreadPriority
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetThreadContext
SetThreadContext
GetSystemTime
SystemTimeToFileTime
FindClose
FlushFileBuffers
GetFullPathNameW
GetCurrentDirectoryW
SetEndOfFile
GetConsoleCP
SetFilePointerEx
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
OutputDebugStringW
GetACP
HeapFree
HeapReAlloc
HeapAlloc
GetModuleFileNameW
GetModuleFileNameA
WriteFile
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
WideCharToMultiByte
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
LoadLibraryExW
InterlockedFlushSList
RaiseException
RtlUnwind
ReadFile
GetConsoleMode
ReadConsoleW
CreateFileW
GetDriveTypeW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
GetModuleHandleExW
SetConsoleCtrlHandler
CreateThread
ExitThread
FreeLibraryAndExitThread
ReadConsoleInputA
SetConsoleMode
GetTimeZoneInformation

user32

MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation

advapi32

ReportEventA
RegisterEventSourceA
DeregisterEventSource

iphlpapi

GetAdaptersAddresses

Exports

Exports

?getInfoString@XYLive@@YAHPADI0@Z
?getVersion@XYLive@@YAHPADI@Z
?init@XYLive@@YAXXZ
?networkChanged@XYLive@@YAHXZ
?playurl_rewrite@XYLive@@YAHPBDPADI@Z
?release@XYLive@@YAXXZ
?setLogEnable@XYLive@@YAHH@Z
?setLogHandler@XYLive@@YAHP6AXHPAD@Z@Z
?setPlayerBufferTime@XYLive@@YAHPBDI@Z
?updatePlayUrl@XYLive@@YAXPBD0@Z

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 405KB - Virtual size: 404KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 696KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ctors
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dtors
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 1024B - Virtual size: 580B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1d29605188d48c08f65bbf82f4503935

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

advapi32

iphlpapi

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 405KB - Virtual size: 404KB

.data Size: 40KB - Virtual size: 696KB

.ctors Size: 512B - Virtual size: 4B

.dtors Size: 512B - Virtual size: 4B

.gfids Size: 1024B - Virtual size: 580B

.tls Size: 6KB - Virtual size: 6KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 62KB - Virtual size: 62KB

.rmnet Size: 56KB - Virtual size: 60KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 405KB - Virtual size: 404KB

.data
Size: 40KB - Virtual size: 696KB

.ctors
Size: 512B - Virtual size: 4B

.dtors
Size: 512B - Virtual size: 4B

.gfids
Size: 1024B - Virtual size: 580B

.tls
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 62KB - Virtual size: 62KB

.rmnet
Size: 56KB - Virtual size: 60KB