5fd3b31012ad548a52b4946838e9a88355dea72093c3c234ae7c8d7d54d3fe1a

Sharing

Copy URL

Twitter E-mail

General

Target

5fd3b31012ad548a52b4946838e9a88355dea72093c3c234ae7c8d7d54d3fe1a
Size

13.3MB
MD5

6c43bde9e92ede01ea156928f949ff6f
SHA1

a4da12a71e789594b1226f528362722d813dea24
SHA256

5fd3b31012ad548a52b4946838e9a88355dea72093c3c234ae7c8d7d54d3fe1a
SHA512

63776a73fa7d0c71ee1d0bcefd86084589ba4e578e6d14e2b424bffb6df8ed571aede8a0b66b561fcb33aa111e7203f8efc5894928ed3ef471623c86bb01ffa0
SSDEEP

196608:kk7+svIwZyoQbitkDZ+9uttvfbh++LyK3e:/VIwZyBIkl+9etvfbh++LF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5fd3b31012ad548a52b4946838e9a88355dea72093c3c234ae7c8d7d54d3fe1a

Files

5fd3b31012ad548a52b4946838e9a88355dea72093c3c234ae7c8d7d54d3fe1a
.exe windows:6 windows x64 arch:x64

177879d030f78876e6fb3ae7119ed4a2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

speedtreert_64

??3CSpeedTreeRT@@SAXPEAX@Z
??1CSpeedTreeRT@@QEAA@XZ
??0CSpeedTreeRT@@QEAA@XZ
?SetTime@CSpeedTreeRT@@SAXM@Z
??2CSpeedTreeRT@@SAPEAX_K@Z
?SetCamera@CSpeedTreeRT@@SAXPEBM0@Z
?Compute@CSpeedTreeRT@@QEAA_NPEBMI_N@Z
?MakeInstance@CSpeedTreeRT@@QEAAPEAV1@XZ
?LoadTree@CSpeedTreeRT@@QEAA_NPEBEI@Z
?GetTreeSize@CSpeedTreeRT@@QEBAXAEAM0@Z
?SetTreeSize@CSpeedTreeRT@@QEAAXMM@Z
?SetTreePosition@CSpeedTreeRT@@QEAAXMMM@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QEAAXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QEAAXW4ELightingMethod@1@@Z
?SetFrondLightingMethod@CSpeedTreeRT@@QEAAXW4ELightingMethod@1@@Z
?SetLeafRockingState@CSpeedTreeRT@@QEAAX_N@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QEAAXI@Z
?SetLeafWindMethod@CSpeedTreeRT@@QEAAXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QEAAXW4EWindMethod@1@@Z
?SetFrondWindMethod@CSpeedTreeRT@@QEAAXW4EWindMethod@1@@Z
?SetWindStrength@CSpeedTreeRT@@QEAAMMMM@Z
?ComputeLodLevel@CSpeedTreeRT@@QEAAXXZ
?SetLodLevel@CSpeedTreeRT@@QEAAXM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLimits@CSpeedTreeRT@@QEAAXMM@Z
?GetDiscreteLeafLodLevel@CSpeedTreeRT@@QEBAGM@Z
?GetNumBranchLodLevels@CSpeedTreeRT@@QEBAGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QEBAGXZ
?GetNumFrondLodLevels@CSpeedTreeRT@@QEBAGXZ
?GetGeometry@CSpeedTreeRT@@QEAAXAEAUSGeometry@1@KFFF@Z
?GetTextures@CSpeedTreeRT@@QEBAXAEAUSTextures@1@@Z
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetBoundingBox@CSpeedTreeRT@@QEBAXPEAM@Z
??0SGeometry@CSpeedTreeRT@@QEAA@XZ
??1SGeometry@CSpeedTreeRT@@QEAA@XZ
??0STextures@CSpeedTreeRT@@QEAA@XZ
??1STextures@CSpeedTreeRT@@QEAA@XZ
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPEBM@Z
?Authorize@CSpeedTreeRT@@SAXPEBD@Z

elementskill_64

?GetName@ElementSkill@GNET@@SAPEB_WI@Z
?GetCommonCoolDown@ElementSkill@GNET@@SAHI@Z
?Query@VisibleState@GNET@@SAPEBV12@HH@Z
?GetEffect@ElementSkill@GNET@@SAPEBDI@Z
?GoblinLearn@ElementSkill@GNET@@SAHIAEAUGoblinRequirement@2@H@Z
?Create@ElementSkill@GNET@@SAPEAV12@IH@Z
?Destroy@ElementSkill@GNET@@QEAAXXZ
?Condition@ElementSkill@GNET@@SAHIAEAUUseRequirement@2@H@Z
?GetAbilityPercent@ElementSkill@GNET@@SAHI@Z
?LearnCondition@ElementSkill@GNET@@SAHIAEAULearnRequirement@2@H@Z
?PetLearn@ElementSkill@GNET@@SAHIAEAUPetRequirement@2@H@Z
?SetLevel@ElementSkill@GNET@@SAHIH@Z
?GetComboSkActivated@ElementSkill@GNET@@SAXAEBUComboSkillState@2@AEAV?$vector@U?$pair@IH@std@@V?$allocator@U?$pair@IH@std@@@2@@std@@@Z
?SetAbility@ElementSkill@GNET@@SAHIH@Z
?LoadSkillData@ElementSkill@GNET@@SAXPEAX@Z
?GoblinCondition@ElementSkill@GNET@@SAHIAEAUGoblinUseRequirement@2@H@Z
?GetVersion@ElementSkill@GNET@@SAHXZ
?GetExecuteTime@ElementSkill@GNET@@SAHIH@Z
?GetNativeName@ElementSkill@GNET@@SAPEBDI@Z
?GetIcon@ElementSkill@GNET@@SAPEBDI@Z
?GetRequiredMoney@ElementSkill@GNET@@SAHIH@Z
?GetRequiredSp@ElementSkill@GNET@@SAHIH@Z
?Query@TeamState@GNET@@SAPEBV12@H@Z
?IsGoblinSkill@ElementSkill@GNET@@SA_NI@Z
?GetType@ElementSkill@GNET@@SADI@Z
?GetRequiredRealmLevel@ElementSkill@GNET@@SAHIH@Z
?GetRequiredLevel@ElementSkill@GNET@@SAHIH@Z
?IsOverridden@ElementSkill@GNET@@SA_NI@Z
?GetMaxAbility@ElementSkill@GNET@@SAHIH@Z
?GetAbility@ElementSkill@GNET@@SAHI@Z
?IsMovingSkill@ElementSkill@GNET@@SA_NI@Z
?InitStaticData@ElementSkill@GNET@@SAXXZ
?GetInherentSkills@ElementSkill@GNET@@SAAEBV?$vector@IV?$allocator@I@std@@@std@@H@Z
?GetComboSkPreSkill@ElementSkill@GNET@@SAHI@Z
?NextSkill@ElementSkill@GNET@@SAII@Z
?GetRequiredBook@ElementSkill@GNET@@SAHIH@Z

d3dx9_43

D3DXLoadSurfaceFromSurface
D3DXGetImageInfoFromFileA
D3DXVec4Transform
D3DXMatrixRotationX
D3DXMatrixRotationY
D3DXMatrixRotationZ
D3DXPlaneTransform
D3DXVec3TransformCoord
D3DXMatrixLookAtLH
D3DXCreateEffectCompiler
D3DXGetShaderConstantTable
D3DXCompileShader
D3DXCreateCubeTextureFromFileInMemoryEx
D3DXSaveVolumeToFileA
D3DXCreateVolumeTextureFromFileInMemoryEx
D3DXMatrixOrthoOffCenterLH
D3DXAssembleShader
D3DXCreateBuffer
D3DXLoadSurfaceFromFileInMemory
D3DXMatrixRotationQuaternion
D3DXQuaternionRotationMatrix
D3DXMatrixPerspectiveFovLH
D3DXGetImageInfoFromFileInMemory
D3DXCreateTextureFromFileInMemoryEx
D3DXSaveSurfaceToFileA
D3DXMatrixMultiply
D3DXMatrixRotationAxis
D3DXMatrixInverse
D3DXDeclaratorFromFVF

winmm

timeGetTime

ws2_32

inet_ntoa
sendto
ioctlsocket
setsockopt
WSACleanup
connect
WSAStartup
ntohs
socket
gethostbyname
WSAGetLastError
inet_addr
getsockname
select
send
closesocket
recv
__WSAFDIsSet
bind
htons

imm32

ImmSetCompositionWindow
ImmGetCandidateListW
ImmGetContext
ImmReleaseContext
ImmGetProperty
ImmGetCompositionStringW
ImmAssociateContext
ImmSetCandidateWindow
ImmGetDescriptionW
ImmNotifyIME
ImmIsIME

dsound

ord11

shlwapi

PathAppendW
PathFindExtensionA
PathIsFileSpecA
PathFileExistsW
StrToIntW
PathCombineA
PathCanonicalizeA
PathRemoveFileSpecA
PathFileExistsA
PathFindFileNameA

wininet

HttpQueryInfoA
InternetCloseHandle
InternetReadFile
InternetConnectA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetOpenA

glu32

gluTessProperty
gluTessEndPolygon
gluDeleteTess
gluNewTess
gluTessBeginContour
gluTessBeginPolygon
gluTessEndContour
gluTessVertex
gluTessCallback

kernel32

WinExec
IsDBCSLeadByteEx
GlobalReAlloc
GlobalSize
GetWindowsDirectoryA
GlobalFree
LocalAlloc
UnmapViewOfFile
SetFilePointer
QueryPerformanceCounter
QueryPerformanceFrequency
LoadLibraryExW
MulDiv
lstrcmpW
lstrcmpiW
CreateFileMappingW
MapViewOfFile
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
VirtualQuery
LoadLibraryExA
LocalFree
FormatMessageA
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueueUserAPC
FindResourceW
LoadResource
RaiseException
SetLastError
SizeofResource
CreateSemaphoreW
ReleaseSemaphore
OpenFile
SetCurrentDirectoryW
GetPrivateProfileStringA
GetPrivateProfileIntA
GetVersion
DuplicateHandle
SetCurrentDirectoryA
GetCurrentDirectoryA
SetThreadPriorityBoost
SuspendThread
SetThreadPriority
GetDiskFreeSpaceA
WaitForSingleObjectEx
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
EncodePointer
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
InterlockedPushEntrySList
GetModuleFileNameA
EnterCriticalSection
GetCurrentProcess
GetModuleFileNameW
LeaveCriticalSection
CreateFileW
GetCurrentThreadId
GetLastError
GetCurrentThread
CloseHandle
LoadLibraryW
GetProcAddress
GetCurrentProcessId
FreeLibrary
lstrcpyW
IsBadReadPtr
GetTempPathA
GetTempFileNameA
GetTickCount
GetCommandLineA
GetFileAttributesA
WritePrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetTickCount64
VirtualProtect
InitializeCriticalSection
WaitForSingleObject
GetModuleHandleA
LoadLibraryA
CreateThread
DeleteCriticalSection
Process32First
TerminateProcess
OpenProcess
CreateToolhelp32Snapshot
Process32Next
ReadProcessMemory
VirtualQueryEx
lstrlenA
GetVersionExW
Sleep
CreateFileA
GetSystemInfo
GlobalMemoryStatus
HeapFree
HeapAlloc
GetProcessHeap
SystemTimeToFileTime
GetSystemTime
GetModuleHandleW
FlushInstructionCache
CreateMutexW
ReleaseMutex
IsBadWritePtr
OutputDebugStringW
GlobalAlloc
GlobalLock
WideCharToMultiByte
GlobalUnlock
MultiByteToWideChar
DeleteFileA
InitializeCriticalSectionAndSpinCount
CreateEventW
SetEvent
GetCurrentDirectoryW
DecodePointer
CreateDirectoryA
FindFirstFileA
FindNextFileA
WaitForMultipleObjects
GetExitCodeThread
CopyFileA
ResetEvent
GetLocalTime
GetFileSize
ReadFile
GetCommandLineW
OutputDebugStringA
CreateDirectoryW
ResumeThread
ExitProcess
FindClose
IsDebuggerPresent
WriteFile
CreateNamedPipeW
CreateMutexA
CreateProcessW
ConnectNamedPipe

user32

SetWindowLongA
DestroyAcceleratorTable
IsChild
GetSysColor
CreateAcceleratorTableW
SetFocus
CharNextW
GetDlgItem
KillTimer
GetDesktopWindow
GetClassInfoExW
GetParent
RegisterWindowMessageW
GetAncestor
ReleaseDC
DefWindowProcW
MessageBoxW
CreateWindowExW
GetSystemMetrics
RegisterClassExW
MoveWindow
AdjustWindowRect
LoadCursorW
UpdateWindow
SetForegroundWindow
wsprintfW
GetCapture
SetCapture
RedrawWindow
SetTimer
InvalidateRgn
GetWindowLongPtrW
FillRect
SetWindowLongPtrW
keybd_event
ReleaseCapture
ChangeDisplaySettingsW
DispatchMessageW
GetDC
PeekMessageW
GetForegroundWindow
DestroyWindow
LoadIconW
SetCursor
GetGUIThreadInfo
BeginPaint
EndPaint
SetWindowTextW
SetCursorPos
AdjustWindowRectEx
SetWindowLongW
InvalidateRect
GetAsyncKeyState
SetActiveWindow
EnumChildWindows
GetFocus
CallWindowProcW
GetMessageW
GetWindowTextLengthW
IntersectRect
RegisterClipboardFormatW
SendMessageW
UnregisterClassW
GetMenuBarInfo
IsWindow
GetWindowLongW
IsWindowVisible
SetWindowPos
ShowWindow
IsWindowEnabled
FindWindowW
GetClassNameW
IsZoomed
IsIconic
GetWindowTextW
GetActiveWindow
GetClientRect
PostMessageW
ClientToScreen
GetKeyState
OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData
ScreenToClient
GetCursorPos
PostQuitMessage
EnumWindows
GetWindowRect
CallNextHookEx
UnhookWindowsHookEx
IsRectEmpty
SetWindowsHookExW
FindWindowA
PtInRect
GetWindowThreadProcessId
GetWindow
GetClassNameA
GetWindowTextA
GetTopWindow
MessageBoxA
GetWindowDC
EnumThreadWindows
IsWindowUnicode
SetCaretPos
GetKeyboardLayout
EnumDisplaySettingsW
CreateCaret
LoadCursorFromFileA
DestroyCursor
TranslateMessage
SetRect
GetClipboardData

gdi32

SetTextColor
CreateDIBSection
SetMapMode
GetTextExtentPoint32W
CreateFontW
GetDIBits
EnumFontFamiliesExW
CreateFontIndirectW
SetBkColor
CreatePolygonRgn
GetGlyphOutlineW
CreateEllipticRgn
CreateSolidBrush
SetTextAlign
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetDeviceCaps
DeleteDC
GetObjectW
GetStockObject
BitBlt
PtInRegion
ExtTextOutW
DeleteObject

advapi32

OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
RegQueryInfoKeyW
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
OpenThreadToken

shell32

ShellExecuteExA
SHOpenFolderAndSelectItems
ShellExecuteA
Shell_NotifyIconW
ShellExecuteW
SHGetFolderPathW

ole32

CoInitialize
CoUninitialize
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CLSIDFromProgID
OleLockRunning
CoTaskMemFree
CreateStreamOnHGlobal
CLSIDFromString
CoInitializeEx
CoGetClassObject
CoTaskMemAlloc
OleInitialize
CoTaskMemRealloc
OleUninitialize
StringFromGUID2

oleaut32

VariantClear
SysAllocString
VarUI4FromStr
SysStringLen
SysAllocStringLen
SysFreeString
VariantCopy
LoadRegTypeLi
VariantInit
LoadTypeLi
OleCreateFontIndirect

msvcp140

?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?good@ios_base@std@@QEBA_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Random_device@std@@YAIXZ
?_Xout_of_range@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
??Bid@locale@std@@QEAA_KXZ
?_Xbad_function_call@std@@YAXXZ
_Unlink
_Remove_dir
_To_wide
_Close_dir
_Open_dir
_Lstat
_Read_dir
_Stat
_To_byte
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Mtx_init_in_situ
_Mtx_destroy_in_situ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z

urlmon

URLDownloadToFileW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp
__current_exception
__current_exception_context
memmove
__std_terminate
strstr
strrchr
__std_exception_destroy
__std_exception_copy
memcpy
_purecall
_CxxThrowException
__C_specific_handler
wcsstr
memchr
_local_unwind
wcsrchr
memset
__RTDynamicCast
__std_type_info_name
strchr
__std_type_info_compare
longjmp
wcschr
__intrinsic_setjmp

api-ms-win-crt-stdio-l1-1-0

_fseeki64
ungetc
fputs
setvbuf
__stdio_common_vswscanf
fwrite
fread
fflush
fclose
fgetwc
fgetws
__stdio_common_vfwprintf
fgets
fopen
feof
_wfopen
__stdio_common_vsprintf_s
__stdio_common_vswprintf_s
__stdio_common_vswprintf
__p__commode
__stdio_common_vsscanf
__acrt_iob_func
__stdio_common_vfprintf
rewind
_set_fmode
_popen
tmpfile
fseek
_fileno
ftell
__stdio_common_vsprintf
_pclose
_chsize
_ftelli64
tmpnam
__stdio_common_vfscanf
freopen
ferror
getc
clearerr

api-ms-win-crt-string-l1-1-0

islower
isspace
isalpha
isalnum
strncat
iscntrl
wcsncmp
_strlwr
toupper
strcoll
_strnicmp
strncmp
strcpy_s
strpbrk
_wcsicmp
_wcslwr
wcsncpy
_wcsupr
_stricmp
strcspn
isupper
iswdigit
wcsncpy_s
strcmp
strncpy
isdigit
tolower
strncpy_s
strtok
isxdigit
ispunct
wcsncat

api-ms-win-crt-utility-l1-1-0

rand
srand
qsort

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
terminate
_crt_atexit
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
exit
_set_app_type
_seh_filter_exe
strerror
system
_register_onexit_function
_errno
_invalid_parameter_noinfo
_resetstkoflw
_beginthread
_beginthreadex

api-ms-win-crt-filesystem-l1-1-0

rename
_rmdir
_stat64i32
_access
_mkdir
_findnext64i32
_findfirst64i32
remove
_findclose
_splitpath
_fstat64i32

api-ms-win-crt-time-l1-1-0

_gmtime64
strftime
_localtime64
_mktime64
asctime
_difftime64
_time64
clock

api-ms-win-crt-heap-l1-1-0

realloc
_recalloc
calloc
free
malloc
_set_new_mode

api-ms-win-crt-convert-l1-1-0

_itow
_itoa
atoi
strtoul
strtod
_wtoi
atof

api-ms-win-crt-math-l1-1-0

log
fmod
floorf
floor
expf
exp
cosh
cosf
cos
ceilf
logf
atan2f
atan2
asinf
asin
acosf
acos
modf
pow
tanh
log10
powf
sin
sinf
sinh
__setusermatherr
frexp
ldexp
sqrt
sqrtf
tanf
ceil
_isnan
tan
atan

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
setlocale
localeconv

ftdriver_64

?CreateFTManager@@YAPEAVIFTManager@@HHH@Z

api-ms-win-crt-environment-l1-1-0

getenv

Exports

Exports

AmdPowerXpressRequestHighPerformance
NvOptimusEnablement

Sections

.text
Size: 10.4MB - Virtual size: 10.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 347KB - Virtual size: 576KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 424KB - Virtual size: 424KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 155KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

177879d030f78876e6fb3ae7119ed4a2

Headers

DLL Characteristics

File Characteristics

Imports

speedtreert_64

elementskill_64

d3dx9_43

winmm

ws2_32

imm32

dsound

shlwapi

wininet

glu32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msvcp140

urlmon

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

ftdriver_64

api-ms-win-crt-environment-l1-1-0

Exports

Exports

Sections

.text Size: 10.4MB - Virtual size: 10.4MB

.rdata Size: 1.8MB - Virtual size: 1.8MB

.data Size: 347KB - Virtual size: 576KB

.pdata Size: 424KB - Virtual size: 424KB

_RDATA Size: 155KB - Virtual size: 154KB

.rsrc Size: 79KB - Virtual size: 78KB

.reloc Size: 96KB - Virtual size: 95KB

.text
Size: 10.4MB - Virtual size: 10.4MB

.rdata
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 347KB - Virtual size: 576KB

.pdata
Size: 424KB - Virtual size: 424KB

_RDATA
Size: 155KB - Virtual size: 154KB

.rsrc
Size: 79KB - Virtual size: 78KB

.reloc
Size: 96KB - Virtual size: 95KB