ab9938906683a45e6d3dccc52db0811c443d3be4b445db9d0e7c02d607ff0ed2

Sharing

Copy URL Twitter E-mail

General

Target

ab9938906683a45e6d3dccc52db0811c443d3be4b445db9d0e7c02d607ff0ed2
Size

4.8MB
MD5

b1110eda2b99af865671239e9070024c
SHA1

25ee49da2a3a1fd910cd707ead8b4d4c9f35ca00
SHA256

ab9938906683a45e6d3dccc52db0811c443d3be4b445db9d0e7c02d607ff0ed2
SHA512

b1f3a33d586ebb5937c6e3bceb907ff0cb5b212d2ad9049e8c643fb52499c44539589e5e63647d92717e0808e4414d9ad0e2d6202bec1ab45c81c6452ab54a3d
SSDEEP

49152:rL6bJdb8jPkNFIbIe5OkwbYvKcqEqfBJVwPp1Y2izP3wSunn2OPO35HX0AniwwNa:r0DaYkBvK5i2OOBEAniF25

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ab9938906683a45e6d3dccc52db0811c443d3be4b445db9d0e7c02d607ff0ed2

Files

ab9938906683a45e6d3dccc52db0811c443d3be4b445db9d0e7c02d607ff0ed2
.exe windows:4 windows x86

47a16139d44436fb7e13c942279f722a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

soundlib

CreateSoundLib

imm32

ImmGetContext
ImmSetOpenStatus
ImmReleaseContext
ImmNotifyIME
ImmGetDefaultIMEWnd

ss3dgfunc

_TransformVector3_VPTR2@16
_SetRotationYMatrix@8
_SetRotationXMatrix@8
_RotatePositionWithPivot@24
_VBHSelect@20
_VBHInsert@16
_CrossProduct@12
_VBHCreate@0
_VBHDeleteAll@4
_VBHRelease@4
_VECTOR3Length@4
_CalcDistance@8
_WriteTGA@24
_COLORtoDWORD@16
_VBHInitialize@16
_Normalize@8
_SetInverseMatrix@8
_TransformV3TOV4@16
_MatrixMultiply2@12

dinput8

DirectInput8Create

kernel32

FindClose
FindNextFileA
DeleteFileA
RemoveDirectoryA
FindFirstFileA
CloseHandle
FileTimeToSystemTime
GetCurrentDirectoryA
GetWindowsDirectoryA
InterlockedIncrement
InterlockedDecrement
lstrlenW
lstrlenA
GetLastError
MulDiv
FlushInstructionCache
GetCurrentProcess
HeapAlloc
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcmpA
WideCharToMultiByte
GetModuleFileNameA
GetModuleHandleA
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
GetCurrentThreadId
FormatMessageA
lstrcpyA
IsBadReadPtr
SetUnhandledExceptionFilter
GetTickCount
Sleep
OutputDebugStringA
GetLocalTime
ReadFile
GetFileSize
CreateFileA
GetProcAddress
LoadLibraryA
InterlockedCompareExchange
WriteFile
CreateDirectoryA
GetSystemTime
OpenFile
CreateThread
SetCurrentDirectoryA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoA
ExitProcess
LocalFree
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
MultiByteToWideChar
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapFree
GetProcessHeap
DebugBreak

user32

OpenClipboard
GetClipboardData
CloseClipboard
CharPrevA
MoveWindow
OffsetRect
SetCursor
LoadCursorFromFileA
CopyRect
SetRect
PostMessageA
MessageBoxA
PeekMessageA
TranslateMessage
DispatchMessageA
RegisterWindowMessageA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
GetClassInfoExA
LoadCursorA
CreateAcceleratorTableA
CharNextA
GetParent
IsClipboardFormatAvailable
SetWindowPos
DestroyWindow
RedrawWindow
IsWindow
GetDlgItem
SendMessageA
SetFocus
GetFocus
IsChild
GetWindow
DestroyAcceleratorTable
BeginPaint
EndPaint
CallWindowProcA
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
GetClientRect
FillRect
SetCapture
ReleaseCapture
GetSysColor
LoadIconA
RegisterClassExA
UnregisterClassA
EndDialog
DefWindowProcA
PostQuitMessage
GetSystemMetrics
GetDesktopWindow
GetWindowRect
CreateWindowExA
GetSystemMenu
EnableMenuItem
ShowWindow
UpdateWindow
ShowCursor
wsprintfA
GetWindowLongA
SetWindowLongA
ScreenToClient
GetCursorPos
IsIconic
GetForegroundWindow
GetClassNameA

gdi32

GetObjectA
DeleteObject
SelectObject
DeleteDC
CreateCompatibleBitmap
GetTextExtentPoint32A
CreateFontIndirectA
CreateSolidBrush
GetStockObject
GetDeviceCaps
BitBlt
CreateCompatibleDC

advapi32

RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegOpenKeyExA
RegCloseKey
RegQueryInfoKeyA
RegEnumKeyExA
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegSetValueExA

shell32

ShellExecuteA

ole32

CoTaskMemAlloc
OleLockRunning
StringFromGUID2
CoCreateInstance
CoInitialize
CreateStreamOnHGlobal
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoTaskMemFree
CoTaskMemRealloc
OleInitialize
OleUninitialize
CoFreeUnusedLibraries
CoUninitialize

oleaut32

VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
VariantInit
VariantClear
OleCreateFontIndirect
SysStringByteLen
SysStringLen
SysFreeString
SysAllocString
SysAllocStringLen
CreateErrorInfo
GetErrorInfo
VariantChangeType
SetErrorInfo

freeimage

_FreeImage_GetBits@4
_FreeImage_ConvertTo16Bits565@4
_FreeImage_GetInfo@4
_FreeImage_Load@12
_FreeImage_SaveJPEG@12
_FreeImage_Unload@4

msvcr71d

??0exception@@QAE@ABQBD@Z
__p__fmode
__uncaught_exception
strtod
islower
setlocale
memcmp
_local_unwind2
___mb_cur_max_func
___unguarded_readlc_active_add_func
memset
_lock
_unlock
___lc_handle_func
___lc_codepage_func
isupper
__pctype_func
__crtLCMapStringA
memcpy
strlen
_callnewh
strcpy
_assert
_access
_strupr
atol
_mbsnbcmp
printf
_mbsnbicmp
_mbsicmp
_mbstok
strncmp
floor
strcspn
strstr
strncat
atof
ftell
fread
fgetc
fseek
fwrite
strchr
isdigit
_strtoui64
_strtoi64
strtol
memchr
localeconv
_errno
strtoul
??0bad_cast@@QAE@PBD@Z
_strcmpi
_itoa
_stricmp
_strnicmp
wcslen
__security_error_handler
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__dllonexit
_onexit
_iob
_c_exit
__p__commode
__set_app_type
sscanf
_CRT_RTC_INIT
_controlfp
_exit
_XcptFilter
_cexit
exit
_ismbblead
_acmdln
?what@exception@@UBEPBDXZ
strrchr
_purecall
_adjust_fdiv
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
vsprintf
_i64toa
_atoi64
_mbslen
_mbsnbcpy
_mbsinc
_CIpow
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
memmove
strncpy
atoi
time
rand
srand
sprintf
realloc
_resetstkoflw
??_V@YAXPAX@Z
free
fopen
fscanf
fclose
fprintf
__CxxFrameHandler
??3@YAXPAX@Z
_except_handler3
_amsg_exit
__getmainargs
_initterm
___setlc_active_func
__setusermatherr
strtok
abort
malloc
_CxxThrowException
fgets

winmm

timeGetTime

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 212KB - Virtual size: 211KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.4MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

47a16139d44436fb7e13c942279f722a

Headers

File Characteristics

Imports

soundlib

imm32

ss3dgfunc

dinput8

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

freeimage

msvcr71d

winmm

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 212KB - Virtual size: 211KB

.data Size: 1.4MB - Virtual size: 1.6MB

.rsrc Size: 1.4MB - Virtual size: 1.4MB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 212KB - Virtual size: 211KB

.data
Size: 1.4MB - Virtual size: 1.6MB

.rsrc
Size: 1.4MB - Virtual size: 1.4MB