79bf84fb2bbbb131c1e77a0d8d36d79e

Sharing

Copy URL

Twitter E-mail

General

Target

79bf84fb2bbbb131c1e77a0d8d36d79e
Size

17KB
MD5

79bf84fb2bbbb131c1e77a0d8d36d79e
SHA1

aa162db133c58c8175b44d777ec46b099c103368
SHA256

3275cd6105ecc45e6ec522d064641a9e133c5054ab59f6e917fa4dc431e37d56
SHA512

104d50638ebb82dbc7e6b4013261ea24f863e07526ec18a5fd58295c1f6ca869f352f290f1841714374ae6fb2d5c9d8c1be217f6dec74695d4903cfd26826e19
SSDEEP

384:BqqPP9qpkIrtHqtGmVzlBj3vQC482WZa69JNbfBhCPa:wqPVIkA8thVzlB0+2WZ3bfXOa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
79bf84fb2bbbb131c1e77a0d8d36d79e

Files

79bf84fb2bbbb131c1e77a0d8d36d79e
.dll windows:5 windows x86 arch:x86

468e4c914e09ac4784f6d3cb88f28b2b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\исходники\grandsteal\stealer\SFPlugin\Release\SFPlugin.pdb

Imports

sampfuncs.asi

?initPlugin@SAMPFUNCS@@QAE_NP6GXXZPAUHINSTANCE__@@@Z
??0BitStream@@QAE@XZ
?Write@BitStream@@QAEXPBDH@Z
?getSAMP@SAMPFUNCS@@QAEPAVSFSAMP@@XZ
?ResetReadPointer@BitStream@@QAEXXZ
?ResetWritePointer@BitStream@@QAEXXZ
?IgnoreBits@BitStream@@QAEXH@Z
?WriteBits@BitStream@@QAEXPBEH_N@Z
?Read@BitStream@@QAE_NPADH@Z
?getDialog@SFSAMP@@QAEPAUstDialogInfo@@XZ
?GAME@@3PAVCGame@@A
?registerChatCommand@SFSAMP@@QAE_NV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@P6GX0@Z@Z
?getRakNet@SAMPFUNCS@@QAEPAVSFRakNet@@XZ
?getInfo@SFSAMP@@QAEPAUstSAMP@@XZ
?IsInitialized@SFSAMP@@QAE_NXZ
?SendRPC@SFRakNet@@QAE_NHPAVBitStream@@W4PacketPriority@@W4PacketReliability@@D_N@Z
?registerRakNetCallback@SFRakNet@@QAEXW4RakNetScriptHookType@@P6G_NPAUstRakNetHookParams@@@Z@Z
?ReadBits@BitStream@@QAE_NPAEH_N@Z

kernel32

GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
DecodePointer
IsDebuggerPresent
GetModuleHandleA
GetModuleFileNameA
LoadLibraryA
OpenMutexA
lstrcmpiW
GetCurrentProcess
IsProcessorFeaturePresent
EncodePointer
GetFileAttributesA
VirtualProtect
CloseHandle
WriteFile
CreateFileA

advapi32

RegQueryValueExA
RegOpenKeyExA

msvcp120

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ

psapi

GetModuleInformation

ws2_32

closesocket
connect
htons
recv
send
socket
gethostbyname
WSAStartup
WSACleanup

msvcr120

_malloc_crt
_initterm
_initterm_e
_except_handler4_common
?terminate@@YAXXZ
__clean_type_info_names_internal
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_purecall
free
_amsg_exit
__CppXcptFilter
??1type_info@@UAE@XZ
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
_beginthread
??_V@YAXPAX@Z
ftell
_strdup
??2@YAPAXI@Z
??3@YAXPAX@Z
fclose
fprintf
tmpfile
sprintf
memmove
strchr
strncpy
isalnum
_CxxThrowException
__CxxFrameHandler3
memcpy
memset
strrchr
strstr
strtok
fopen
fread
fseek

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

468e4c914e09ac4784f6d3cb88f28b2b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

sampfuncs.asi

kernel32

advapi32

msvcp120

psapi

ws2_32

msvcr120

Sections

.text Size: 9KB - Virtual size: 9KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 19KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 9KB - Virtual size: 9KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 19KB

.reloc
Size: 1KB - Virtual size: 1KB