c6e72ce2d89ce9db674c1f97f3d9221aa577cf2866046acb782cc1a9ad377873

Sharing

Copy URL Twitter E-mail

General

Target

c6e72ce2d89ce9db674c1f97f3d9221aa577cf2866046acb782cc1a9ad377873
Size

8.9MB
MD5

f545e8e58131cf0336cd0231b8ed67b8
SHA1

d5f97f6d3fd2e5a1c47e9d945b47cdfdf97e1f22
SHA256

c6e72ce2d89ce9db674c1f97f3d9221aa577cf2866046acb782cc1a9ad377873
SHA512

9fa61a585627b1d0f3792dda5de9f0562396faba5724a3fb9efb97ca8c900fcaae7a1c579500ec093c52d9db1d62d618e27054ae156296c103d6e70be927264e
SSDEEP

196608:LPbITWVfn07kviR3oW6chs/KAx3IlmdAuYA:LPsTWVf0R3y/KAlIl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c6e72ce2d89ce9db674c1f97f3d9221aa577cf2866046acb782cc1a9ad377873

Files

c6e72ce2d89ce9db674c1f97f3d9221aa577cf2866046acb782cc1a9ad377873
.exe windows:5 windows x86 arch:x86

0220284e08dfcc9d80f47be20dbec71e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

d3d9

Direct3DCreate9

winmm

timeGetTime

dinput8

DirectInput8Create

imm32

ImmNotifyIME
ImmGetContext
ImmReleaseContext
ImmSetOpenStatus
ImmSetCompositionFontA
ImmSetCompositionWindow
ImmGetCompositionStringA
ImmGetCandidateListA
ImmGetOpenStatus
ImmGetProperty
ImmSetCandidateWindow
ImmGetCandidateWindow
ImmIsIME
ImmSetConversionStatus
ImmGetConversionStatus
ImmSetCompositionStringW
ImmGetCompositionWindow

ws2_32

WSASetEvent
WSAResetEvent
WSAWaitForMultipleEvents
WSAIoctl
getpeername
freeaddrinfo
recvfrom
WSAAsyncGetHostByName
WSAAsyncGetHostByAddr
WSAAsyncSelect
getsockname
gethostbyaddr
getsockopt
sendto
shutdown
select
accept
listen
htonl
bind
setsockopt
ntohs
ioctlsocket
recv
send
WSAStartup
gethostname
WSACleanup
htons
gethostbyname
inet_ntoa
socket
WSASetLastError
connect
WSACreateEvent
WSAEventSelect
WSASend
WSAEnumNetworkEvents
WSARecv
WSAGetLastError
WSACloseEvent
closesocket
inet_addr
getaddrinfo
__WSAFDIsSet

ijl11

ord2
ord5
ord3

dsetup

ord11

ddraw

DirectDrawCreateEx

wininet

InternetOpenA
InternetReadFile
InternetCloseHandle
InternetReadFileExA
InternetSetStatusCallback
HttpSendRequestA
InternetCrackUrlA
FtpPutFileA
InternetConnectA
HttpOpenRequestA
HttpQueryInfoA
HttpEndRequestA
HttpSendRequestExA

kilos

?OAL_allocate_sample_handle@@YGPAU__SAMPLE_OAL@@PAU_OPENAL_DIG_DRIVER@@@Z
?OAL_file_read@@YGPAXPBDPAX@Z
?OAL_release_sample_handle@@YGXPAU__SAMPLE_OAL@@@Z
?OAL_mem_free_lock@@YGXPAX@Z
?OAL_close_stream@@YGXPAU__STREAM_OAL@@@Z
?OAL_start_stream@@YGXPAU__STREAM_OAL@@@Z
?OAL_open_stream@@YGPAU__STREAM_OAL@@PAU_OPENAL_DIG_DRIVER@@PBDH@Z
?OAL_stream_status@@YGHPAU__STREAM_OAL@@@Z
?OAL_set_sample_volume_levels@@YGXPAU__SAMPLE_OAL@@MM@Z
?OAL_sample_status@@YGHPAU__SAMPLE_OAL@@@Z
?OAL_open_digital_driver@@YGPAU_OPENAL_DIG_DRIVER@@KHHI@Z
?OAL_startup@@YGXH@Z
?OAL_shutdown@@YGXXZ
?OAL_close_digital_driver@@YGXPAU_OPENAL_DIG_DRIVER@@@Z
?OAL_set_stream_loop_count@@YGXPAU__STREAM_OAL@@H@Z
?OAL_start_sample@@YGXPAU__SAMPLE_OAL@@@Z
?OAL_set_sample_file@@YGHPAU__SAMPLE_OAL@@PBXH@Z

libeay32

ord3040
ord3033
ord3106

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

steam_api

SteamAPI_GetHSteamPipe
SteamAPI_GetHSteamUser
SteamAPI_Init
SteamAPI_Shutdown
SteamInternal_ContextInit
SteamAPI_IsSteamRunning
SteamInternal_CreateInterface
SteamAPI_RestartAppIfNecessary

kernel32

CreateTimerQueue
MoveFileA
GetDateFormatA
GetTimeFormatA
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
LoadLibraryW
OutputDebugStringW
SwitchToThread
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
TlsGetValue
GetSystemTimeAsFileTime
RtlUnwind
RaiseException
ExitProcess
DecodePointer
EncodePointer
HeapReAlloc
GetCommandLineA
HeapSetInformation
IsValidCodePage
GetOEMCP
GetACP
SetStdHandle
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapDestroy
HeapCreate
HeapSize
GetFileType
GetStdHandle
SetHandleCount
lstrlenA
GetTickCount
OutputDebugStringA
CloseHandle
SetFilePointer
ReadFile
CreateFileA
WriteFile
GetLocalTime
Sleep
GetFileSize
QueryPerformanceCounter
QueryPerformanceFrequency
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryA
lstrcatA
GetModuleFileNameA
GetFileAttributesA
lstrcpyA
DeviceIoControl
LocalFree
GetCurrentProcess
GetLastError
WritePrivateProfileStringA
GetPrivateProfileStringA
GetCurrentDirectoryW
GetModuleHandleA
GlobalUnlock
GlobalLock
GlobalAlloc
CreateDirectoryA
FindClose
FindFirstFileA
Process32Next
Process32First
CreateToolhelp32Snapshot
VerifyVersionInfoA
VerSetConditionMask
GetVersionExA
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
FindNextFileA
DeleteFileA
CopyFileA
SetUnhandledExceptionFilter
RemoveDirectoryA
GetCurrentDirectoryA
GlobalMemoryStatus
LeaveCriticalSection
EnterCriticalSection
SetThreadPriority
CreateThread
InitializeCriticalSection
TerminateThread
GetLocaleInfoW
SetLastError
VirtualFree
GetModuleHandleW
VirtualAlloc
lstrlenW
GetModuleFileNameW
UnmapViewOfFile
GetSystemInfo
MapViewOfFile
CreateFileMappingA
SetCurrentDirectoryA
DeleteCriticalSection
_lread
_lclose
_lopen
_llseek
CreateFileW
GetVolumeInformationW
GetDriveTypeW
FindNextFileW
FindFirstFileW
FormatMessageA
IsBadWritePtr
IsBadReadPtr
IsDBCSLeadByteEx
Module32Next
Module32First
GlobalMemoryStatusEx
GetTimeZoneInformation
SystemTimeToFileTime
IsDBCSLeadByte
InterlockedDecrement
InterlockedIncrement
GlobalFree
GetVersion
IsWow64Process
GetEnvironmentVariableA
GetTempFileNameA
GetTempPathA
IsProcessorFeaturePresent
GetProfileIntA
DebugBreak
FatalAppExitA
LockResource
LoadResource
SizeofResource
FindResourceA
FindResourceW
InterlockedExchange
InterlockedCompareExchange
GetFullPathNameA
lstrcmpiA
HeapAlloc
GetProcessHeap
HeapFree
GetStartupInfoW
CreateProcessA
DuplicateHandle
LCMapStringW
GetCPInfo
UnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsSetValue
TlsFree
SetCurrentDirectoryW
SetConsoleCtrlHandler
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
VirtualQuery
CreatePipe
GetExitCodeProcess
CompareStringW
WriteConsoleW
SetEndOfFile
GetThreadPriority
SetEnvironmentVariableA
SignalObjectAndWait
SleepEx
GetSystemDirectoryW
VerifyVersionInfoW
FormatMessageW
MoveFileExW
DeleteTimerQueueTimer
CreateTimerQueueTimer
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
ReleaseSemaphore
InitializeSListHead
InterlockedPushEntrySList
QueryDepthSList
SetEvent
InterlockedPopEntrySList
InterlockedFlushSList
CreateSemaphoreW
WaitForMultipleObjects
CreateEventW
WaitForSingleObject
GetVersionExW
GetProcessAffinityMask
PeekNamedPipe
GetFileInformationByHandle
SetThreadAffinityMask
GetExitCodeThread
VirtualProtect
FindFirstFileExA
FindFirstFileExW
GetFileAttributesW
GetPrivateProfileIntA
GetFullPathNameW
ExitThread

user32

ClipCursor
OffsetRect
IntersectRect
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
EnumWindows
FindWindowA
SystemParametersInfoA
ShowCursor
GetClassNameA
GetWindowTextA
EndDialog
SetFocus
wsprintfA
OpenClipboard
EmptyClipboard
AdjustWindowRectEx
CloseClipboard
SetWindowPos
PtInRect
SetCursor
SendMessageA
ChangeDisplaySettingsA
LoadCursorA
RegisterClassA
GetCaretPos
ClientToScreen
GetWindowLongA
CreateWindowExA
SetWindowLongA
ShowWindow
DrawTextA
DefWindowProcA
DestroyWindow
GetAsyncKeyState
PostMessageA
SetClipboardData
GetMenu
SetCursorPos
GetCursorPos
GetClientRect
ScreenToClient
GetIconInfo
AdjustWindowRect
LoadIconA
GetKeyState
SetActiveWindow
SetForegroundWindow
PostQuitMessage
DestroyMenu
DispatchMessageA
TranslateMessage
GetMessageA
GetDC
ReleaseDC
GetActiveWindow
MessageBoxA
SetRect
UnionRect
FillRect
EnumDisplaySettingsA
SetWindowsHookExA
ToAscii
CallNextHookEx
UnhookWindowsHookEx
GetWindowRgn
GetCursor
DrawIcon
InvalidateRect
GetPropA
SetPropA
RemovePropA
BeginPaint
EndPaint
UnregisterClassA
SetRectEmpty
CopyRect
GetClassInfoA
LoadStringA
GetKeyboardState
GetLastActivePopup
MessageBoxW
keybd_event
MoveWindow
CharLowerA
GetKeyboardLayout
PeekMessageA

gdi32

CreateRectRgn
OffsetRgn
SelectClipRgn
CreateDIBSection
BitBlt
CreateDIBitmap
Rectangle
AddFontResourceA
TextOutA
CreateSolidBrush
SetMapMode
GetObjectW
GetCharacterPlacementA
GetCharacterPlacementW
GetTextMetricsA
GetTextMetricsW
GetFontLanguageInfo
CreateFontIndirectA
CreateFontIndirectW
MoveToEx
ExtTextOutW
RemoveFontResourceA
GetClipBox
GetDCOrgEx
CreateFontA
GetStockObject
GetObjectA
CreateCompatibleDC
GetDIBits
SelectObject
SetBkMode
SetTextColor
SetBkColor
DeleteDC
SetTextAlign
ExtTextOutA
DeleteObject
GetTextExtentPoint32A

comdlg32

GetOpenFileNameA

advapi32

CryptReleaseContext
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextW
CryptImportKey
RegOpenKeyA
RegCreateKeyExA
RegSetValueExA
OpenProcessToken
GetTokenInformation
ConvertSidToStringSidA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CryptEncrypt
CryptDestroyKey
CryptGetHashParam

shell32

ShellExecuteA

ole32

CoUninitialize
CLSIDFromString
CoInitialize
CoCreateInstance

oleaut32

VariantChangeType
GetErrorInfo
SetErrorInfo
SysFreeString
SysAllocString
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
VariantInit
VariantClear
CreateErrorInfo

netapi32

NetApiBufferFree
NetWkstaGetInfo

wldap32

ord79
ord167
ord133
ord26
ord142
ord145
ord219
ord14
ord117
ord208
ord301
ord27
ord216
ord46
ord147
ord127
ord41

Sections

.text
Size: 7.5MB - Virtual size: 7.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 123KB - Virtual size: 66.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0220284e08dfcc9d80f47be20dbec71e

Headers

DLL Characteristics

File Characteristics

Imports

d3d9

winmm

dinput8

imm32

ws2_32

ijl11

dsetup

ddraw

wininet

kilos

libeay32

version

steam_api

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

netapi32

wldap32

Sections

.text Size: 7.5MB - Virtual size: 7.5MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 123KB - Virtual size: 66.3MB

.rsrc Size: 80KB - Virtual size: 80KB

.text
Size: 7.5MB - Virtual size: 7.5MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 123KB - Virtual size: 66.3MB

.rsrc
Size: 80KB - Virtual size: 80KB