AmdPowerXpressRequestHighPerformance
D3D12SDKPath
D3D12SDKVersion
NvOptimusEnablement
Static task
static1
1 signatures
General
-
Target
teardown.exe
-
Size
7.2MB
-
MD5
ef3554f2167516fdacc831c2b12c38a2
-
SHA1
fa0bfa772fa86131bc80de9f9781d24692a84245
-
SHA256
72ad2d49e59e938fd1017b98676c84b4eb7f3450d2e3e067a5d5cdd462377312
-
SHA512
f03ada6e26d749455c9c04d0f8b26d384661181581a5c5c53d28843331e2b524fef5a10141fadac2ff8fbf72d3a701ba926ebfb11aea6736529b465c08cfe1f7
-
SSDEEP
49152:5KNBaAhQFq8yMUJCUR7SytKkDGYGzSNFyA5G6RX5wegep/2XtFEvDdygRe0PiMJM:Fvy5DnKkH19eEvdRk9/Trva06C6rgRP
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource teardown.exe
Files
-
teardown.exe.exe windows:6 windows x64 arch:x64
4c9a2a3f29e200698d3ac11d7de7a23f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
wsock32
WSAStartup
WSACleanup
accept
bind
closesocket
getsockname
htonl
gethostbyname
ntohs
connect
inet_ntoa
recv
select
send
ntohl
setsockopt
shutdown
listen
htons
socket
ws2_32
getnameinfo
opengl32
wglGetCurrentDC
wglGetProcAddress
glGetError
glBindTexture
glBlendFunc
glClear
glClearColor
glColorMask
glCullFace
glDeleteTextures
glDepthFunc
glDepthMask
glDisable
glEnable
glFinish
glGetIntegerv
glFlush
glGenTextures
glLineWidth
glPixelStorei
glPolygonMode
glPolygonOffset
glReadBuffer
glReadPixels
glScissor
glStencilFunc
glStencilMask
glStencilOp
glTexImage2D
glTexParameterfv
glTexParameteri
glTexSubImage2D
glViewport
wglCreateContext
wglDeleteContext
wglMakeCurrent
glGetString
dxgi
CreateDXGIFactory1
dbghelp
SymFromAddr
SymInitialize
MiniDumpWriteDump
SymSetOptions
SymGetModuleBase64
SymFunctionTableAccess64
StackWalk64
SymCleanup
pros.sdk.x64
prosdk_account_get_qr_code
prosdk_account_connect
prosdk_user_get_kernel_session_id_visual_alias
prosdk_user_get_connection_state
prosdk_user_connect_psn_token
prosdk_user_connect_xbox
prosdk_user_connect_steam
prosdk_account_get_status
prosdk_user_connect_developer
prosdk_authorization_user_create
prosdk_telemetry_user_event
prosdk_telemetry_deprecated_event
prosdk_mods_connect
prosdk_mods_disconnect
prosdk_http_request_get_framed
prosdk_mods_subscribe_to_mod
prosdk_mods_unsubscribe_from_mod
prosdk_mods_add_mod
prosdk_mods_add_mod_version
prosdk_mods_upload_mod_image
prosdk_mods_rate_mod
prosdk_init
prosdk_update
prosdk_container_transfer_upload_rawdata
hydra5_diagnostics_get_crash_reporter_user_token
prosdk_disconnect_everything
hydra5_diagnostics_release_crash_reporter_user_token
prosdk_term
prosdk_is_executing_requests
prosdk_get_error_message
prosdk_user_connect_epic_online_services
prosdk_http_request_get
prosdk_mods_get_connection_state
kernel32
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
CreatePipe
SetConsoleCtrlHandler
SetEndOfFile
HeapQueryInformation
HeapSize
SetFileAttributesW
GetFileInformationByHandleEx
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
GetTickCount64
GetSystemTimeAsFileTime
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
InitOnceExecuteOnce
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetFileInformationByHandle
LCMapStringEx
DecodePointer
EncodePointer
GetLocaleInfoEx
LocalFree
GetNativeSystemInfo
GetExitCodeThread
SwitchToThread
WaitForSingleObjectEx
MoveFileExW
DeleteFileW
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapReAlloc
SetStdHandle
GetTimeZoneInformation
GetFileAttributesExW
GetExitCodeProcess
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTempPathW
HeapAlloc
HeapFree
WriteFile
GetStdHandle
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateProcessW
GetModuleHandleExW
ExitProcess
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
GetFileInformationByHandle
GetDriveTypeW
DuplicateHandle
ReadFile
GetEnvironmentStringsW
WriteConsoleW
GetDiskFreeSpaceExA
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
LocaleNameToLCID
GetUserDefaultLocaleName
OutputDebugStringA
GlobalMemoryStatusEx
GetCurrentProcess
K32GetProcessMemoryInfo
RtlCaptureContext
CreateFileW
CloseHandle
SetUnhandledExceptionFilter
SetErrorMode
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
VirtualQuery
GetModuleFileNameW
GetModuleHandleExA
GetModuleHandleA
GetProcAddress
IsDebuggerPresent
SwitchToFiber
DeleteFiber
ConvertFiberToThread
CreateFiber
ConvertThreadToFiber
GetLastError
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventA
CreateSemaphoreA
GetFileAttributesA
QueryPerformanceCounter
Sleep
GetSystemInfo
CreateThread
SetThreadPriority
TerminateThread
SetThreadAffinityMask
GetCPInfo
CreateDirectoryA
DeleteFileA
FindClose
FindFirstFileA
FindNextFileA
RemoveDirectoryA
MoveFileA
GetCurrentDirectoryA
GetModuleFileNameA
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
CreateEventW
GetModuleHandleW
GetLocalTime
LoadLibraryA
FreeLibrary
LoadLibraryW
K32EnumProcessModules
FormatMessageA
WaitForMultipleObjectsEx
TryAcquireSRWLockShared
TryAcquireSRWLockExclusive
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
CreateSymbolicLinkW
GetStringTypeW
InitializeCriticalSectionAndSpinCount
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
InitializeSListHead
TerminateProcess
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedPushEntrySList
GetCommandLineW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
LoadLibraryExW
InterlockedFlushSList
SetLastError
RtlUnwind
TlsAlloc
TlsGetValue
OutputDebugStringW
CompareStringEx
TlsFree
QueryPerformanceFrequency
TlsSetValue
user32
GetMonitorInfoA
EnumDisplayMonitors
GetSystemMetrics
TranslateMessage
DispatchMessageA
PeekMessageA
DefWindowProcA
PostQuitMessage
RegisterClassA
UnregisterClassA
CreateWindowExA
DestroyWindow
ShowWindow
SetWindowPos
SetClipboardData
GetActiveWindow
SetCapture
ReleaseCapture
SetForegroundWindow
GetDC
ReleaseDC
GetWindowRect
GetRawInputData
RegisterRawInputDevices
GetForegroundWindow
ChangeDisplaySettingsExA
AdjustWindowRectEx
MessageBoxA
ShowCursor
SetCursorPos
ClientToScreen
OpenClipboard
SetFocus
GetClipboardData
SetWindowLongPtrA
SetClassLongPtrA
LoadCursorA
CloseClipboard
LoadIconA
DisplayConfigGetDeviceInfo
QueryDisplayConfig
EmptyClipboard
GetDisplayConfigBufferSizes
gdi32
SwapBuffers
ChoosePixelFormat
SetPixelFormat
shell32
SHGetSpecialFolderPathA
ShellExecuteA
ole32
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance
CoUninitialize
oleaut32
GetErrorInfo
VariantChangeType
CreateErrorInfo
SetErrorInfo
VariantClear
VariantInit
SysFreeString
SysAllocString
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext
steam_api64
SteamAPI_GetHSteamUser
SteamInternal_ContextInit
SteamInternal_FindOrCreateUserInterface
SteamAPI_RunCallbacks
SteamInternal_CreateInterface
SteamAPI_RegisterCallback
SteamAPI_UnregisterCallback
SteamAPI_RegisterCallResult
SteamAPI_UnregisterCallResult
SteamAPI_Init
SteamAPI_Shutdown
dsound
ord1
Exports
Exports
Sections
.text Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 316KB - Virtual size: 460KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 206KB - Virtual size: 205KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ