credits_to_unknown_[.]rar

Sharing

Copy URL

Twitter E-mail

General

Target

credits_to_unknown_.rar
Size

281KB
MD5

c8133cae5ab6c986dca3abc026c95277
SHA1

0df2aaf805e93924d799e3487472a6efb8fb5d44
SHA256

b211f5998b2bc0f9a2bbc99c9f529edc4f9503d3f15d09feef246b73d95c8b89
SHA512

55f8e8e7c7e6f4fb2696efd267b23d533bd31c30a9e45a780a38b75223e3a6411ee737e61ea134714cd6208f8256a94a3eb69f8bee5a9014dd0983a34d3d1928
SSDEEP

6144:dcCjyaiDZExd1JVWmRHgupLWaOXa/LGI2NhUNLZO/DG/43:+TbSd3VWa9piXq6wNLo/DK43

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/SPOILER_0044_dark.exe

Files

credits_to_unknown_.rar
.rar
SPOILER_0044_dark.exe
.exe windows:6 windows x64

c580ed167fadd5a138b59cabcbb102a8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

dwmapi

DwmExtendFrameIntoClientArea

kernel32

GlobalLock
GlobalFree
QueryPerformanceCounter
QueryPerformanceFrequency
GetStdHandle
CreateFileA
FlushFileBuffers
Beep
Sleep
GetCurrentProcessId
CreateThread
GetCurrentThread
VirtualAlloc
MultiByteToWideChar
WideCharToMultiByte
GlobalUnlock
SetConsoleTextAttribute
SetConsoleTitleA
GlobalAlloc
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetModuleHandleW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetSystemTimeAsFileTime
InitializeSListHead

user32

GetWindow
GetWindowThreadProcessId
FindWindowA
SetWindowLongA
GetWindowLongA
GetWindowRect
GetForegroundWindow
UpdateWindow
mouse_event
GetAsyncKeyState
SetWindowPos
MoveWindow
ShowWindow
DestroyWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
PostQuitMessage
DefWindowProcA
PeekMessageA
DispatchMessageA
TranslateMessage
LoadCursorA
ScreenToClient
ClientToScreen
GetCursorPos
SetClipboardData
OpenClipboard
CloseClipboard
SetCursorPos
GetClipboardData
EmptyClipboard
GetActiveWindow
GetKeyState
GetCapture
SetCapture
ReleaseCapture
GetClientRect
SetCursor

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

msvcp140

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?id@?$ctype@D@std@@2V0locale@2@A
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
?uncaught_exceptions@std@@YAHXZ
_Xtime_get_ticks
_Thrd_detach
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

d3d9

Direct3DCreate9Ex

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlAdjustPrivilege
ZwCreateKey
ZwSetValueKey
ZwOpenKey
ZwClose
ZwQueryValueKey
NtRaiseHardError

xinput1_4

ord2

urlmon

URLDownloadToFileA

vcruntime140

memset
__current_exception_context
__current_exception
__std_terminate
strstr
__C_specific_handler
memchr
memcpy
memmove
__std_exception_destroy
memcmp
__std_exception_copy
_CxxThrowException

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strncpy
strcmp
isprint
wcscpy_s

api-ms-win-crt-stdio-l1-1-0

ftell
fwrite
fread
__stdio_common_vfprintf
__p__commode
fflush
__stdio_common_vsnprintf_s
__stdio_common_vsprintf_s
_wfopen
__stdio_common_vsprintf
_set_fmode
__stdio_common_vsscanf
fclose
fseek
__acrt_iob_func

api-ms-win-crt-heap-l1-1-0

free
_callnewh
_set_new_mode
malloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

__setusermatherr
tanf
asin
atan2
powf
pow
fmodf
atan2f
ceilf
cosf
floorf
sinf
sqrtf

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_register_thread_local_exe_atexit_callback
_c_exit
_invalid_parameter_noinfo_noreturn
__p___argv
__p___argc
exit
system
_beginthreadex
_exit
_initterm
_get_initial_narrow_environment
terminate
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function

api-ms-win-crt-filesystem-l1-1-0

remove

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 302KB - Virtual size: 302KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 176KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
key.txt

Sharing

General

Malware Config

Signatures

Files

c580ed167fadd5a138b59cabcbb102a8

Headers

DLL Characteristics

File Characteristics

Imports

dwmapi

kernel32

user32

imm32

msvcp140

d3d9

ntdll

xinput1_4

urlmon

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 302KB - Virtual size: 302KB

.rdata Size: 176KB - Virtual size: 175KB

.data Size: 8KB - Virtual size: 12KB

.pdata Size: 13KB - Virtual size: 12KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 302KB - Virtual size: 302KB

.rdata
Size: 176KB - Virtual size: 175KB

.data
Size: 8KB - Virtual size: 12KB

.pdata
Size: 13KB - Virtual size: 12KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 1KB - Virtual size: 1KB