midifileplayer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

midifileplayer.exe
Size

428KB
MD5

5e5ea2ee226ae275c48772aaaa2528c3
SHA1

28d1aa1b78549fff4f12409e9913da7f1665ab29
SHA256

d223cecd8dbf7c0c4d70ffb2bf2d9a3cb4e63fc03f297c25e9a7cc4bea723850
SHA512

a8b439270c3945f194ea077193ce868169051ba1adb36513004441ec8bffd035ddc0613464505b089e8aa8463871cbf1a9faa7e350032cb6985867208408a387
SSDEEP

6144:xqfrJyHodL2JMJBmPW8VvHkiTyvHMdZtRFSguI0KCqSQI9FI4rBYj90jB7Oa:y2JYBmPW8VvpaQHZ0KXSFW4rBYj9aO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
midifileplayer.exe

Files

midifileplayer.exe
.exe windows:4 windows x86

17be931b2cc74354fb1c4769a6ec9fb7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemTimeAsFileTime
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
WaitForSingleObject
SetEvent
GetTempFileNameA
ExitThread
CreateThread
CreateEventA
RaiseException
GetOEMCP
GetACP
CompareStringW
CompareStringA
GetCPInfo
SetStdHandle
SetEndOfFile
SetEnvironmentVariableA
SetEnvironmentVariableW
FlushFileBuffers
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
RtlUnwind
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
WideCharToMultiByte
GetModuleHandleA
GetStartupInfoA
SetHandleCount
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
GetModuleFileNameA
InterlockedIncrement
LoadLibraryA
GetProcAddress
OutputDebugStringA
InterlockedDecrement
WriteFile
DebugBreak
HeapAlloc
PeekNamedPipe
GetFileInformationByHandle
FileTimeToLocalFileTime
FileTimeToSystemTime
SetFilePointer
CreateFileA
GetFileType
CloseHandle
MultiByteToWideChar
GetLocalTime
GetSystemTime
GetTimeZoneInformation
GetVersion
GetCommandLineA
DeleteFileA
GetCurrentProcess
TerminateProcess
ExitProcess
HeapValidate
IsBadReadPtr
IsBadWritePtr
GetLastError
ReadFile
WaitForMultipleObjects
GetStdHandle
ExpandEnvironmentStringsA

winmm

midiOutShortMsg
midiOutOpen
midiOutClose
timeGetTime

ws2_32

WSAAsyncSelect
getpeername
gethostbyname
inet_addr
htons
WSAGetLastError
socket
WSAStartup
recvfrom
sendto
WSACleanup
closesocket
setsockopt
ioctlsocket
inet_ntoa
htonl
gethostname
select
ntohs
__WSAFDIsSet
send
connect
gethostbyaddr
bind
listen
getsockname
accept
WSACreateEvent
WSAEventSelect
WSAEnumNetworkEvents
ntohl
recv
shutdown

glib-1.2

g_mem_chunk_new
g_mem_chunk_alloc
g_strerror
g_mem_chunk_reset
g_array_set_size
g_slist_free_1
g_slist_remove_link
g_array_append_vals
g_array_new
g_slist_prepend
g_free
g_malloc
g_logv
g_list_prepend
g_list_free_1
g_list_remove_link
g_slist_free
g_slist_foreach
g_list_remove
g_ptr_array_new
g_log
g_list_find
g_ptr_array_set_size
g_atexit
g_strdup
g_malloc0
g_hash_table_insert
g_hash_table_new
g_str_hash
g_str_equal
g_ptr_array_add
g_hash_table_lookup
g_hash_table_remove
g_slist_append
g_mem_chunk_free
g_slist_length
g_get_home_dir
g_hash_table_destroy
g_hash_table_foreach_remove
g_realloc
g_slist_nth_data
g_slist_remove
g_snprintf
g_array_free

Sections

.text
Size: 356KB - Virtual size: 352KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

17be931b2cc74354fb1c4769a6ec9fb7

Headers

File Characteristics

Imports

kernel32

winmm

ws2_32

glib-1.2

Sections

.text Size: 356KB - Virtual size: 352KB

.rdata Size: 32KB - Virtual size: 30KB

.data Size: 36KB - Virtual size: 43KB

.text
Size: 356KB - Virtual size: 352KB

.rdata
Size: 32KB - Virtual size: 30KB

.data
Size: 36KB - Virtual size: 43KB