679ebb22208131eb06652e1beab5d9936a6b972414d1fee51636de58fda8a543

Sharing

Copy URL Twitter E-mail

General

Target

679ebb22208131eb06652e1beab5d9936a6b972414d1fee51636de58fda8a543
Size

1.4MB
MD5

f504a4badfa89a1ad6b7270f21803ee4
SHA1

f3b3f6ad118e42c94bae0cb2ab7587406f268c92
SHA256

679ebb22208131eb06652e1beab5d9936a6b972414d1fee51636de58fda8a543
SHA512

142c039e46f8d9d312d943beb7aefbda19322d344c9c56c98db9dac264bbe98e17aab8fff05df09e14f860382ca2da47feb4bc94d9b72412e3ff3b7ce755b16a
SSDEEP

12288:IdoaeADyxpAyYokEHwgGlrt5EFsP7BoqJjW798XHAi9H1OW2/IYIKRdUcEtDN40u:ILeAM7OEHzGiF5mCqXlVWI1WdsD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
679ebb22208131eb06652e1beab5d9936a6b972414d1fee51636de58fda8a543

Files

679ebb22208131eb06652e1beab5d9936a6b972414d1fee51636de58fda8a543
.exe windows:6 windows x64 arch:x64

24036022d1cc88101a226346f302cc70

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\SourceCode\GC3.Service\production_V5.1\GamingCenter.Service\ServiceSDK\Release\ArmouryCrate.UserSessionHelper.pdb

Imports

kernel32

GetCurrentProcess
TerminateProcess
InitializeCriticalSectionEx
OutputDebugStringW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
OpenEventW
FreeLibrary
ResetEvent
Sleep
TerminateThread
FlushFileBuffers
GetEnvironmentVariableW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileSizeEx
GetCurrentProcessId
ConnectNamedPipe
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LoadLibraryExW
CreateDirectoryW
VerifyVersionInfoW
VerSetConditionMask
LocalFree
GetOverlappedResult
GetLastError
DisconnectNamedPipe
LocalAlloc
WaitForMultipleObjects
CreateNamedPipeW
WriteFile
ReadFile
DeleteCriticalSection
GetCurrentThreadId
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetUnhandledExceptionFilter
OpenThread
CreateThread
CloseHandle
SetEvent
CreateEventW
AddDllDirectory
WaitForSingleObject

user32

TranslateMessage
DispatchMessageW
ChangeWindowMessageFilterEx
RegisterPowerSettingNotification
RegisterClassExW
UnregisterDeviceNotification
RegisterDeviceNotificationW
PostMessageW
DefWindowProcW
PostQuitMessage
UnregisterPowerSettingNotification
CreateWindowExW
GetMessageW

advapi32

RegCloseKey
RegCreateKeyExW
RegQueryValueExW
SetSecurityDescriptorDacl
AllocateAndInitializeSid
SetEntriesInAclW
ConvertStringSidToSidW
FreeSid
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
AddAccessAllowedAce
SetFileSecurityW
RegNotifyChangeKeyValue

shell32

SHGetFolderPathW

oleaut32

VariantClear

msvcp140

??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAPEAX@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_frequency
_Query_perf_counter
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ

shlwapi

PathIsDirectoryW
PathFileExistsW

wtsapi32

WTSRegisterSessionNotification
WTSUnRegisterSessionNotification

wintrust

WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData

crypt32

CertGetNameStringW

vcruntime140

wcsrchr
__C_specific_handler
__CxxFrameHandler3
_set_purecall_handler
__std_terminate
_purecall
set_unexpected
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcpy
memmove
memset

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo
terminate
_set_abort_behavior
signal
_invalid_parameter_noinfo_noreturn
_errno
_register_thread_local_exe_atexit_callback
_c_exit
__p___wargv
__pxcptinfoptrs
set_terminate
_set_invalid_parameter_handler
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_set_new_handler
_configure_wide_argv
_initialize_wide_environment
_get_initial_wide_environment
_initterm
_initterm_e
exit
_exit
__p___argc

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
_set_new_mode
free

api-ms-win-crt-stdio-l1-1-0

fflush
fclose
__stdio_common_vswprintf
_wfsopen
__stdio_common_vswprintf_s
__p__commode
__acrt_iob_func
__stdio_common_vfwprintf
_set_fmode

api-ms-win-crt-string-l1-1-0

wcscpy_s
wcstok_s
_wcsicmp
wcsncat_s
wcsnlen
_wcsnicmp
wcscat_s
tolower

api-ms-win-crt-time-l1-1-0

_time64
wcsftime
_localtime64_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

SetThreadOwnersInstances

Sections

.text
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

24036022d1cc88101a226346f302cc70

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

oleaut32

msvcp140

shlwapi

wtsapi32

wintrust

crypt32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 97KB - Virtual size: 97KB

.rdata Size: 40KB - Virtual size: 40KB

.data Size: 1KB - Virtual size: 3KB

.pdata Size: 6KB - Virtual size: 5KB

.rsrc Size: 69KB - Virtual size: 69KB

.reloc Size: 1.2MB - Virtual size: 1.8MB

.text
Size: 97KB - Virtual size: 97KB

.rdata
Size: 40KB - Virtual size: 40KB

.data
Size: 1KB - Virtual size: 3KB

.pdata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 69KB - Virtual size: 69KB

.reloc
Size: 1.2MB - Virtual size: 1.8MB