a576d59ca88fcf00ec4c11353bbef60a413e8dd59c0acb9e5b9c6dea04394d71

Sharing

Copy URL Twitter E-mail

General

Target

a576d59ca88fcf00ec4c11353bbef60a413e8dd59c0acb9e5b9c6dea04394d71
Size

3.8MB
MD5

54926275677b16f4c9643b6eb8e36f4b
SHA1

8df4209cdfcb47e0373ce9e688ffc9b1df4a3e03
SHA256

a576d59ca88fcf00ec4c11353bbef60a413e8dd59c0acb9e5b9c6dea04394d71
SHA512

e8825e00cd4071e13ebbcefc7e0b1b032ae8cad2bcbc4d4ab34aaf163867d58a7a614f4204053d60ebb8f7613aa22714b962dcf302cec17701125ce7b414321e
SSDEEP

49152:0s/LISFF2XyvfSvwygEA4WTDao8zFLPDHGOei4EwqqhhXI4tdIMq/KxAcNPJzR17:F/caF2XyvM7g2QiLHfeiOnq/Kxnda

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a576d59ca88fcf00ec4c11353bbef60a413e8dd59c0acb9e5b9c6dea04394d71

Files

a576d59ca88fcf00ec4c11353bbef60a413e8dd59c0acb9e5b9c6dea04394d71
.dll windows:5 windows x86

eb33a46485590fa7dbc3ded41afa1bc9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

psapi

GetProcessMemoryInfo

hlog

ord18
ord14
ord15

kernel32

LoadLibraryA
VirtualQuery
GetModuleFileNameW
GetProcessHeap
HeapAlloc
HeapFree
Sleep
GetProcAddress
GetCurrentProcess
OutputDebugStringA
QueryPerformanceFrequency
QueryPerformanceCounter
GetModuleFileNameA
GetModuleHandleA
LoadLibraryExA
FreeLibrary
SetThreadPriority
WaitForSingleObject
CloseHandle
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CreateSemaphoreA
ReleaseSemaphore
CreateFileW
CreateFileA
MultiByteToWideChar
ReadFile
WriteFile
GetLastError
SetFilePointer
GetFileSize
WideCharToMultiByte
DebugBreak
RaiseException
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
CreateEventA
GetHandleInformation
SetEvent
ResetEvent

msvcr90

floor
strrchr
remove
memmove
malloc
free
strlen
strstr
_vsnprintf
_invalid_parameter_noinfo
memcmp
memchr
??0exception@std@@QAE@ABV01@@Z
memset
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
memmove_s
_beginthreadex
strtoul
atoi
strchr
toupper
??0exception@std@@QAE@XZ
_ftol
printf
vsprintf_s
strncmp
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__clean_type_info_names_internal
??_V@YAXPAX@Z
strcmp
_mktime64
fwrite
fflush
fclose
_time64
_localtime64
strcpy_s
sprintf_s
fopen
memcpy
_CxxThrowException
??2@YAPAXI@Z
_wfopen
_wassert
_fseeki64
fread
_ftelli64
_CIpow
rand
fseek
ftell
_CRT_RTC_INITW
__CxxFrameHandler3
_purecall
??3@YAXPAX@Z
??0exception@std@@QAE@ABQBD@Z
memcpy_s

Exports

Exports

FC_ConfigLogInfo
FC_CreateHandle
FC_DestroyHandle
FC_EncOneKeyFrame
FC_GetFileInfo
FC_GetProgress
FC_GetSDKVersion
FC_GetSourceMediaInfo
FC_GetTargetSessionInfo
FC_InputSourceData
FC_InputSourceDataAndInfo
FC_Pause
FC_ReSetTimeStamp
FC_RegisterHWImpCallBack
FC_RegisterMsgCallBack
FC_RegisterTargetDataCallback
FC_SetCap
FC_SetCoverRegion
FC_SetDecodeERC
FC_SetDecryptKey
FC_SetEncryptKey
FC_SetExtendInfo
FC_SetFileSwitch
FC_SetGlobalTime
FC_SetSourceSessionInfo
FC_SetTargetMediaInfo
FC_Start
FC_Stop
opus_decoder_get_size
opus_decoder_init
opus_encoder_ctl
opus_encoder_get_size
opus_encoder_init
opus_packet_get_bandwidth
opus_packet_get_nb_channels
opus_packet_get_nb_frames
opus_packet_get_samples_per_frame
opus_repacketizer_cat_1
opus_repacketizer_init

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 143KB - Virtual size: 226KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eb33a46485590fa7dbc3ded41afa1bc9

Headers

DLL Characteristics

File Characteristics

Imports

psapi

hlog

kernel32

msvcr90

Exports

Exports

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rodata Size: 1024B - Virtual size: 832B

.rdata Size: 1.0MB - Virtual size: 1.0MB

.data Size: 143KB - Virtual size: 226KB

.data1 Size: 4KB - Virtual size: 3KB

_RDATA Size: 1KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 53KB - Virtual size: 52KB

.text
Size: 2.6MB - Virtual size: 2.6MB

.rodata
Size: 1024B - Virtual size: 832B

.rdata
Size: 1.0MB - Virtual size: 1.0MB

.data
Size: 143KB - Virtual size: 226KB

.data1
Size: 4KB - Virtual size: 3KB

_RDATA
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 53KB - Virtual size: 52KB