61dd97df8aae8ab29219930ae06de7f1a239632f39bed3c1ebe17d8c34d811ff

Sharing

Copy URL Twitter E-mail

General

Target

61dd97df8aae8ab29219930ae06de7f1a239632f39bed3c1ebe17d8c34d811ff
Size

6.0MB
MD5

948eac4168f946dde181b9bd8706969e
SHA1

7270557d690de49a0ee67bdeacc89b6ca23d6c39
SHA256

61dd97df8aae8ab29219930ae06de7f1a239632f39bed3c1ebe17d8c34d811ff
SHA512

e66cad46831fe356f7eb763ebf3fb952ae8a3b802a33503ed1395ad58e1ad40aebc8ec49442ad970afe8bdfc540c6d24cb03a5dea0b620891806ac60b9ac05e8
SSDEEP

49152:s6mKvA2Nt26pf2dhBDadN52gYjBWrmIcMU+f14DMq58hlGLD7J4TI8yNb2CTTsju:sXJ2bxJvyjK2M8DMnycb2OOBEAniF25

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
61dd97df8aae8ab29219930ae06de7f1a239632f39bed3c1ebe17d8c34d811ff

Files

61dd97df8aae8ab29219930ae06de7f1a239632f39bed3c1ebe17d8c34d811ff
.exe windows:4 windows x86

7159cce7931a13ef8bca8bb7292ea76d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

soundlib

CreateSoundLib

imm32

ImmGetContext
ImmSetOpenStatus
ImmReleaseContext
ImmNotifyIME
ImmGetDefaultIMEWnd

ss3dgfunc

_TransformVector3_VPTR2@16
_SetRotationYMatrix@8
_SetRotationXMatrix@8
_RotatePositionWithPivot@24
_VBHSelect@20
_VBHInsert@16
_CrossProduct@12
_VBHCreate@0
_VBHDeleteAll@4
_VBHRelease@4
_VECTOR3Length@4
_CalcDistance@8
_WriteTGA@24
_COLORtoDWORD@16
_VBHInitialize@16
_Normalize@8
_SetInverseMatrix@8
_TransformV3TOV4@16
_MatrixMultiply2@12

dinput8

DirectInput8Create

kernel32

FindClose
FindNextFileA
DeleteFileA
RemoveDirectoryA
FindFirstFileA
CloseHandle
FileTimeToSystemTime
GetCurrentDirectoryA
GetWindowsDirectoryA
InterlockedIncrement
InterlockedDecrement
lstrlenW
lstrlenA
GetLastError
MulDiv
FlushInstructionCache
GetCurrentProcess
HeapAlloc
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcmpA
WideCharToMultiByte
GetModuleFileNameA
GetModuleHandleA
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
GetCurrentThreadId
FormatMessageA
lstrcpyA
IsBadReadPtr
SetUnhandledExceptionFilter
GetTickCount
Sleep
OutputDebugStringA
GetLocalTime
ReadFile
GetFileSize
CreateFileA
GetProcAddress
LoadLibraryA
InterlockedCompareExchange
WriteFile
CreateDirectoryA
GetSystemTime
OpenFile
CreateThread
SetCurrentDirectoryA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoA
ExitProcess
LocalFree
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
MultiByteToWideChar
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapFree
GetProcessHeap
DebugBreak

user32

OpenClipboard
GetClipboardData
CloseClipboard
CharPrevA
MoveWindow
OffsetRect
SetCursor
LoadCursorFromFileA
CopyRect
SetRect
PostMessageA
MessageBoxA
PeekMessageA
TranslateMessage
DispatchMessageA
RegisterWindowMessageA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
GetClassInfoExA
LoadCursorA
CreateAcceleratorTableA
CharNextA
GetParent
IsClipboardFormatAvailable
SetWindowPos
DestroyWindow
RedrawWindow
IsWindow
GetDlgItem
SendMessageA
SetFocus
GetFocus
IsChild
GetWindow
DestroyAcceleratorTable
BeginPaint
EndPaint
CallWindowProcA
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
GetClientRect
FillRect
SetCapture
ReleaseCapture
GetSysColor
LoadIconA
RegisterClassExA
UnregisterClassA
EndDialog
DefWindowProcA
PostQuitMessage
GetSystemMetrics
GetDesktopWindow
GetWindowRect
CreateWindowExA
GetSystemMenu
EnableMenuItem
ShowWindow
UpdateWindow
ShowCursor
wsprintfA
GetWindowLongA
SetWindowLongA
ScreenToClient
GetCursorPos
IsIconic
GetForegroundWindow
GetClassNameA

gdi32

GetObjectA
DeleteObject
SelectObject
DeleteDC
CreateCompatibleBitmap
GetTextExtentPoint32A
CreateFontIndirectA
CreateSolidBrush
GetStockObject
GetDeviceCaps
BitBlt
CreateCompatibleDC

advapi32

RegDeleteKeyA
RegCreateKeyExA
RegDeleteValueA
RegOpenKeyExA
RegCloseKey
RegQueryInfoKeyA
RegEnumKeyExA
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegSetValueExA

shell32

ShellExecuteA

ole32

CoTaskMemAlloc
OleLockRunning
StringFromGUID2
CoCreateInstance
CoInitialize
CreateStreamOnHGlobal
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoTaskMemFree
CoTaskMemRealloc
OleInitialize
OleUninitialize
CoFreeUnusedLibraries
CoUninitialize

oleaut32

VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
VariantInit
VariantClear
OleCreateFontIndirect
SysStringByteLen
SysStringLen
SysFreeString
SysAllocString
SysAllocStringLen
CreateErrorInfo
GetErrorInfo
VariantChangeType
SetErrorInfo

freeimage

_FreeImage_GetBits@4
_FreeImage_ConvertTo16Bits565@4
_FreeImage_GetInfo@4
_FreeImage_Load@12
_FreeImage_SaveJPEG@12
_FreeImage_Unload@4

msvcr71d

??0exception@@QAE@ABQBD@Z
__p__fmode
__uncaught_exception
strtod
islower
setlocale
memcmp
_local_unwind2
___mb_cur_max_func
___unguarded_readlc_active_add_func
memset
_lock
_unlock
___lc_handle_func
___lc_codepage_func
isupper
__pctype_func
__crtLCMapStringA
memcpy
strlen
_callnewh
strcpy
_assert
_access
_strupr
atol
_mbsnbcmp
printf
_mbsnbicmp
_mbsicmp
_mbstok
strncmp
floor
strcspn
strstr
strncat
atof
ftell
fread
fgetc
fseek
fwrite
strchr
_strtoui64
_strtoi64
strtol
memchr
localeconv
_errno
strtoul
??0bad_cast@@QAE@PBD@Z
??1bad_cast@@UAE@XZ
_strcmpi
_itoa
_stricmp
_strnicmp
wcslen
__security_error_handler
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__dllonexit
_onexit
_iob
_c_exit
__p__commode
sprintf
__set_app_type
_CRT_RTC_INIT
_controlfp
_exit
_XcptFilter
_cexit
exit
_ismbblead
_acmdln
?what@exception@@UBEPBDXZ
sscanf
strrchr
_adjust_fdiv
??0bad_cast@@QAE@ABV0@@Z
vsprintf
_i64toa
_atoi64
_mbslen
_mbsnbcpy
_mbsinc
_CIpow
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
memmove
strncpy
atoi
time
rand
srand
fgets
realloc
_resetstkoflw
??_V@YAXPAX@Z
free
fopen
fscanf
fclose
fprintf
__CxxFrameHandler
??3@YAXPAX@Z
_except_handler3
_CxxThrowException
_amsg_exit
__getmainargs
_initterm
___setlc_active_func
__setusermatherr
_purecall
abort
malloc
strtok

winmm

timeGetTime

Sections

.textbss
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 248KB - Virtual size: 247KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.6MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.7MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7159cce7931a13ef8bca8bb7292ea76d

Headers

File Characteristics

Imports

soundlib

imm32

ss3dgfunc

dinput8

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

freeimage

msvcr71d

winmm

Sections

.textbss Size: - Virtual size: 1.2MB

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 248KB - Virtual size: 247KB

.data Size: 1.6MB - Virtual size: 1.9MB

.idata Size: 12KB - Virtual size: 11KB

.rsrc Size: 1.7MB - Virtual size: 1.6MB

.textbss
Size: - Virtual size: 1.2MB

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 248KB - Virtual size: 247KB

.data
Size: 1.6MB - Virtual size: 1.9MB

.idata
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 1.7MB - Virtual size: 1.6MB