ugcservers_windows_x86-x64[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

ugcservers_windows_x86-x64.zip
Size

1.6MB
MD5

58268b635a7573d6ae8111242dfd93cb
SHA1

752c367cb215887b66cd9c58619b1a9f4068d822
SHA256

cd3748f0185d634a4ff62b9bbf6876e31132293ee9c7a08de4302db8aed8dad4
SHA512

6f9041137b3ec002c6388b3ec2fed034352fff93eaef44b48efd80a4378247b8ecd8e9ac930d12b6a113c0b7a994ec47eb02cf4ca8b690e41e265cdf2eee4a40
SSDEEP

49152:efi78QdqzYDiPUNVyh6gvmgckxePRxovpVm:eDYKYdNVZCdckxy2jm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ugcservers_tf2.exe

Files

ugcservers_windows_x86-x64.zip
.zip
ugcservers_tf2.exe
.exe windows:4 windows x86 arch:x86

7b0aea11265f18f3d6126046e1a0dcd1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

ws2_32

WSAGetOverlappedResult

advapi32

CryptAcquireContextW
CryptGenRandom
CryptReleaseContext

ntdll

NtWaitForSingleObject

kernel32

VirtualAlloc
VirtualFree
CreateIoCompletionPort
GetQueuedCompletionStatus
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateThread
CreateWaitableTimerA
DuplicateHandle
ExitProcess
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetProcAddress
GetStdHandle
GetSystemInfo
GetThreadContext
LoadLibraryW
LoadLibraryA
ResumeThread
SetConsoleCtrlHandler
SetEvent
SetProcessPriorityBoost
SetThreadPriority
SetUnhandledExceptionFilter
SetWaitableTimer
SuspendThread
WaitForSingleObject
WriteFile

winmm

timeBeginPeriod

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 100KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/4
Size: 512B - Virtual size: 253B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/18
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/30
Size: 159KB - Virtual size: 159KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/43
Size: 671KB - Virtual size: 670KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/55
Size: 214KB - Virtual size: 214KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/71
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/87
Size: 512B - Virtual size: 28B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.symtab
Size: 319KB - Virtual size: 319KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7b0aea11265f18f3d6126046e1a0dcd1

Headers

File Characteristics

Imports

ws2_32

advapi32

ntdll

kernel32

winmm

Sections

.text Size: 3.4MB - Virtual size: 3.4MB

.data Size: 100KB - Virtual size: 188KB

/4 Size: 512B - Virtual size: 253B

/18 Size: 164KB - Virtual size: 164KB

/30 Size: 159KB - Virtual size: 159KB

/43 Size: 671KB - Virtual size: 670KB

/55 Size: 214KB - Virtual size: 214KB

/71 Size: 82KB - Virtual size: 81KB

/87 Size: 512B - Virtual size: 28B

.idata Size: 1KB - Virtual size: 1KB

.symtab Size: 319KB - Virtual size: 319KB

.text
Size: 3.4MB - Virtual size: 3.4MB

.data
Size: 100KB - Virtual size: 188KB

/4
Size: 512B - Virtual size: 253B

/18
Size: 164KB - Virtual size: 164KB

/30
Size: 159KB - Virtual size: 159KB

/43
Size: 671KB - Virtual size: 670KB

/55
Size: 214KB - Virtual size: 214KB

/71
Size: 82KB - Virtual size: 81KB

/87
Size: 512B - Virtual size: 28B

.idata
Size: 1KB - Virtual size: 1KB

.symtab
Size: 319KB - Virtual size: 319KB