AmdPowerXpressRequestHighPerformance
IsGameRuntime
NvOptimusEnablement
agsDeInit
agsGetCrossfireGPUCount
agsGetDriverVersionInfo
agsGetEyefinityConfigInfo
agsGetGPUMemorySize
agsGetTotalGPUCount
agsInit
Static task
static1
1 signatures
General
-
Target
MirrorsEdgeCatalyst.exe
-
Size
83.7MB
-
MD5
f502602eef4d64a93e3dd6d8a48ee077
-
SHA1
bd0c31f434dae6c1b470a14e9cd6bbd62badbc4f
-
SHA256
b1b6acf3ca720522c1a329a0ad086335440fd89adf9114f8c636d1546289f790
-
SHA512
8cc8903109af29958ef463545fd5135327da04eac5a1cb1e64dae241590cda1ba4aff995820c797c0f9c746c1c725836c93089edc0eb9a713f9e7b1e8885b914
-
SSDEEP
1572864:4OFkRyNlTsHbl7DAgYsCfFBlP22K6mi8hWsynYL0/Nsb54r:qREIJfAXsmpP2jNhWCI
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource MirrorsEdgeCatalyst.exe
Files
-
MirrorsEdgeCatalyst.exe.exe windows:6 windows x64 arch:x64
Password: 123
b1ca023d72e601d096e87fe09bd53941
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegQueryValueExA
CryptGenRandom
CryptAcquireContextA
CryptReleaseContext
GetCurrentHwProfileA
RegCloseKey
RegGetValueW
crypt32
CertGetNameStringW
CryptMsgGetParam
CertFindCertificateInStore
CertCloseStore
CertGetNameStringA
CryptQueryObject
CertFreeCertificateContext
CryptMsgClose
dinput8
DirectInput8Create
gdi32
ExtEscape
CreateDCW
DeleteDC
GetStockObject
SetDCBrushColor
iphlpapi
GetAdaptersAddresses
kernel32
GetComputerNameW
EnterCriticalSection
InitializeCriticalSection
VirtualProtect
DeleteCriticalSection
LoadLibraryExW
GetProcAddress
FreeLibrary
Sleep
HeapFree
LeaveCriticalSection
QueryPerformanceFrequency
GetSystemDirectoryW
TryEnterCriticalSection
LocalAlloc
SetLastError
LocalFree
ReleaseMutex
TlsGetValue
LoadLibraryW
CopyFileW
SwitchToFiber
VerifyVersionInfoW
GetDiskFreeSpaceA
GetCurrentThread
GetThreadContext
InitializeCriticalSectionAndSpinCount
TlsAlloc
CreateFileW
LoadLibraryA
GetFileSizeEx
GetThreadId
CloseHandle
ReadFile
GetSystemTime
WriteFile
CreateEventExA
GetModuleFileNameA
MultiByteToWideChar
GetGeoInfoA
VerSetConditionMask
VerifyVersionInfoA
VirtualAlloc
GetCurrentThreadId
GlobalMemoryStatusEx
OpenProcess
GetUserDefaultLangID
GlobalUnlock
GetModuleHandleA
GlobalLock
GetCurrentProcessId
SetUnhandledExceptionFilter
SetPriorityClass
IsDebuggerPresent
HeapAlloc
GetVersionExA
CreateDirectoryW
GetLastError
WaitForSingleObjectEx
SetErrorMode
SetWaitableTimer
CreateMutexA
GetCurrentProcess
ReleaseSRWLockExclusive
TerminateProcess
CompareFileTime
lstrcatW
VirtualFree
GetExitCodeThread
DuplicateHandle
GetFileSize
SetThreadAffinityMask
AcquireSRWLockShared
InitializeSRWLock
AcquireSRWLockExclusive
ReleaseSRWLockShared
GetEnvironmentVariableA
CreateDirectoryA
ExitProcess
GetCommandLineA
QueryPerformanceCounter
ResumeThread
RaiseException
SetEnvironmentVariableA
OpenThread
QueueUserAPC
SuspendThread
GetWindowsDirectoryA
GetComputerNameA
GetSystemTimeAsFileTime
CreateEventA
GetFileInformationByHandleEx
SetFilePointerEx
FindClose
DeleteFileA
SleepEx
CreateFileA
DeleteFiber
GetFileInformationByHandle
GetLocalTime
FindNextFileA
SetFileAttributesW
RemoveDirectoryW
DeleteFileW
FlushFileBuffers
GetFileAttributesExW
FindFirstFileW
WideCharToMultiByte
FindNextFileW
GetCurrentDirectoryW
MoveFileW
SetEvent
SetFileInformationByHandle
GetFileAttributesA
WaitForSingleObject
GlobalMemoryStatus
GetSystemInfo
GetTickCount
GetTimeZoneInformation
GetExitCodeProcess
GetProcessHeap
HeapDestroy
GetModuleHandleExA
CreateSemaphoreA
TlsFree
GetTickCount64
ReleaseSemaphore
TlsSetValue
SetThreadPriority
SetThreadIdealProcessor
SwitchToThread
VirtualQuery
OutputDebugStringA
FindFirstFileA
lstrlenA
GetUserGeoID
CreateThread
ConvertThreadToFiber
Process32Next
GetDateFormatA
lstrcmpA
Thread32First
SetEndOfFile
CreateFiber
ResetEvent
CreateNamedPipeA
CreateWaitableTimerA
GetThreadPriority
SetFilePointer
OpenEventA
lstrlenW
FormatMessageA
GetTimeFormatA
lstrcmpiW
GetModuleHandleW
CreateProcessW
AddVectoredExceptionHandler
EncodePointer
DecodePointer
GetCommandLineW
SignalObjectAndWait
RemoveVectoredExceptionHandler
CreateToolhelp32Snapshot
Process32First
IsProcessorFeaturePresent
GetTempPathA
CreateSemaphoreW
SetThreadContext
GetFileAttributesExA
GetTempFileNameA
MoveFileExA
LoadLibraryExA
GetPriorityClass
GetLocaleInfoA
GetWindowsDirectoryW
GetModuleFileNameW
lstrcpyW
QueryFullProcessImageNameW
Thread32Next
HeapReAlloc
lstrcpyA
CreateFileMappingA
CreatePipe
GetUserDefaultUILanguage
msvcp120
?_Winerror_map@std@@YAPEBDH@Z
_Nan
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
_FNan
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_BADOFF@std@@3_JB
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?uncaught_exception@std@@YA_NXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Xbad_function_call@std@@YAXXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??_7ios_base@std@@6B@
?_Ios_base_dtor@ios_base@std@@CAXPEAV12@@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
msvcr120
_difftime64
vsprintf_s
asin
tanf
vswprintf_s
_unlock
strcpy_s
_strupr
free
_fullpath
cosf
??1exception@std@@UEAA@XZ
fwrite
log10f
strchr
memmove
sprintf_s
_stricmp
tanh
isprint
_aligned_malloc
_create_locale
fegetround
malloc
_ismbblead
longjmp
_aligned_free
getenv
exit
sinf
_initterm
fflush
strtoul
strncpy
toupper
log10
__crtTerminateProcess
sscanf
_lock
bsearch
fprintf
strftime
strrchr
_controlfp
fopen
_purecall
strcat
printf
_exit
_dupenv_s
__argv
_snprintf
__argc
atan
_fmode
_strtoi64
clock
isdigit
_HUGE
strerror
ftell
isalnum
fmodf
nextafterf
_set_output_format
strtod
atof
isspace
strnlen
memcmp
_set_purecall_handler
_strnicmp
cosh
_time64
rand
sprintf
fesetround
_vsnprintf_s
strstr
_vsnprintf
atoi
roundf
_beginthreadex
strncmp
strtol
ceilf
strncat
__set_app_type
ferror
_itoa_s
__crtSetUnhandledExceptionFilter
iscntrl
_pclose
calloc
__timezone
srand
_errno
logf
realloc
tolower
_strtoi64_l
__crtGetShowWindowMode
_endthreadex
modf
_wfopen
asinf
__getmainargs
fclose
modff
ldexp
strncpy_s
powf
__iob_func
fread
??0exception@std@@QEAA@AEBV01@@Z
??0exception@std@@QEAA@XZ
atan2f
fputs
qsort
system
__C_specific_handler
_calloc_crt
_commode
_CxxThrowException
wcstombs
_snprintf_s
sinh
_onexit
strtok_s
_finite
_control87
wcsncpy
remove
feof
getc
ungetc
isalpha
localeconv
strcspn
strcoll
_popen
fseek
expf
setvbuf
clearerr
cos
fscanf
fgets
rename
_gmtime64
atanf
_localtime64
_mktime64
setlocale
memchr
islower
ispunct
isupper
isxdigit
_wsplitpath_s
strpbrk
frexp
_aligned_realloc
vsprintf
_isnan
abort
_setjmp
_strdup
__CxxFrameHandler3
memcpy
memset
__setusermatherr
_configthreadlocale
exp
_acmdln
_cexit
atol
acosf
strcmp
ceil
floorf
log
sqrtf
pow
sin
fmod
acos
atan2
tan
sqrt
?terminate@@YAXXZ
__dllonexit
_XcptFilter
_amsg_exit
_initterm_e
__crt_debugger_hook
__crtUnhandledException
__crtCaptureCurrentContext
__crtCapturePreviousContext
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
_vsnprintf_l
_vsprintf_l
_strtoui64_l
_strtod_l
_fcvt
asctime
_strtoui64
_get_tzname
_ecvt
puts
strtok
strlen
strcpy
nvcamerasdk64
updateCamera
setConfiguration
oleaut32
SysAllocString
SysFreeString
VariantInit
SysStringByteLen
VariantClear
psapi
EnumProcesses
EnumProcessModules
GetModuleBaseNameA
GetModuleBaseNameW
shell32
ShellExecuteA
SHGetFolderPathW
CommandLineToArgvW
shlwapi
PathAppendW
StrStrW
user32
GetWindowTextA
SystemParametersInfoA
MessageBoxW
RegisterClassExW
TrackMouseEvent
EnumDisplaySettingsA
GetSysColorBrush
LoadIconA
PostQuitMessage
ScreenToClient
CreateWindowExW
GetWindowRect
GetClientRect
CreateWindowExA
SendMessageA
SetWindowTextA
SetWindowLongPtrA
IsWindow
SetWindowPos
ShowWindow
SetFocus
UpdateWindow
AttachThreadInput
IsWindowVisible
ChangeClipboardChain
PostThreadMessageA
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
PostMessageA
LoadCursorA
SetTimer
GetMessageA
SetWinEventHook
MapVirtualKeyA
TranslateMessage
DispatchMessageA
CloseWindow
IsIconic
SetParent
SetWindowLongA
DefWindowProcW
CallWindowProcW
MoveWindow
DestroyWindow
SetWindowTextW
GetWindowLongA
SetCursorPos
GetKeyboardState
GetWindowThreadProcessId
RegisterRawInputDevices
GetWindowLongPtrA
GetSystemMetrics
GetFocus
MessageBoxA
CallWindowProcA
GetForegroundWindow
SetWindowLongPtrW
GetWindowLongPtrW
ShowCursor
ClipCursor
CharLowerBuffW
RedrawWindow
GetWindowInfo
SetCursor
SetForegroundWindow
PostMessageW
GetRawInputData
DefWindowProcA
SetActiveWindow
MonitorFromPoint
EnumDisplaySettingsW
SetWindowPlacement
GetWindowPlacement
GetAsyncKeyState
GetCursorPos
GetKeyState
EnumChildWindows
usp10
ScriptBreak
ScriptItemize
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
winmm
waveInMessage
waveInStop
timeGetDevCaps
timeBeginPeriod
timeEndPeriod
waveOutPrepareHeader
waveInClose
waveInGetNumDevs
timeGetTime
waveOutMessage
waveInStart
waveOutUnprepareHeader
waveInPrepareHeader
waveInReset
waveOutReset
waveInUnprepareHeader
waveOutClose
waveOutGetNumDevs
waveInGetDevCapsA
waveOutGetDevCapsA
waveInOpen
waveOutOpen
waveOutSetVolume
waveOutWrite
waveInAddBuffer
ws2_32
socket
WSAStartup
freeaddrinfo
ntohs
htons
htonl
inet_addr
gethostbyname
ntohl
WSACleanup
connect
closesocket
WSAResetEvent
WSAGetLastError
shutdown
recv
send
bind
WSAWaitForMultipleEvents
accept
ioctlsocket
getpeername
listen
recvfrom
select
sendto
setsockopt
getsockname
getsockopt
gethostname
WSACloseEvent
WSACreateEvent
WSAGetOverlappedResult
WSAIoctl
WSARecv
WSARecvFrom
WSASetEvent
getaddrinfo
wsock32
__WSAFDIsSet
WSAAsyncSelect
inet_addr
wtsapi32
WTSUnRegisterSessionNotification
WTSRegisterSessionNotification
bcrypt
BCryptImportKeyPair
BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptCloseAlgorithmProvider
BCryptDestroyKey
BCryptVerifySignature
d3d11
D3D11CreateDevice
dbghelp
SymSetOptions
SymLoadModuleEx
SymInitialize
SymCleanup
SymFunctionTableAccess64
SymGetModuleBase64
StackWalk64
MiniDumpWriteDump
dwmapi
ord102
dxgi
CreateDXGIFactory1
ole32
CoInitializeSecurity
CoUninitialize
CoInitializeEx
CoCreateInstance
CoSetProxyBlanket
CoInitialize
CoTaskMemFree
urlmon
URLOpenBlockingStreamA
URLDownloadToCacheFileA
Exports
Exports
Sections
.srdata Size: - Virtual size: 24.5MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.link Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.code Size: 322KB - Virtual size: 5.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sdata Size: 968KB - Virtual size: 968KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 465KB - Virtual size: 465KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 58KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xcode Size: 1024B - Virtual size: 646B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.trace Size: 512B - Virtual size: 349B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.xtext Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.sbss Size: 73.2MB - Virtual size: 73.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xtls Size: 91KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ooa Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ