unlockfps_clr[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

unlockfps_clr.exe
Size

1.4MB
MD5

cff81830eebd3566d51b73ffaa444035
SHA1

d626df1980b27e2a111ab3e4951a3c8d1f6fe5d6
SHA256

40515ad6b9444753609a2c2d7c4da5855796dbdb202f0a0888f9c7e64800772c
SHA512

d15004a4ca88d6f65f79a8e1f5eaa8dfbaad6e993a6adb35faf40069893788398ac8b2fbf4f7d2f46854a693fd59c2fdce99fb65abe6e7aa97ca170cdb14dfd0
SSDEEP

24576:3WqNhDeBXkLiBBmJMqIfOBnYAskD72dowc/PyQCqvhK1Aa49ZOMgYoOejjz1uTaS:GqNhDeBXkLiBBmJMqIfOBnYAskD72doD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unlockfps_clr.exe

Files

unlockfps_clr.exe
.exe windows:6 windows x64 arch:x64

2d70db2db7d70562751b723bc2aa8348

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

SetPriorityClass
GetExitCodeProcess
WriteProcessMemory
ReadProcessMemory
CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
OpenProcess
QueryFullProcessImageNameA
TerminateProcess
FormatMessageA
LocalFree
CreateProcessA
GetLastError
VirtualAlloc
VirtualFree
K32EnumProcessModules
K32GetModuleBaseNameA
K32GetModuleInformation
VirtualAllocEx
GetModuleHandleA
GetProcAddress
CreateRemoteThread
WaitForSingleObject
VirtualFreeEx
Sleep
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
ReleaseMutex
CreateMutexA
OpenMutexA
LockResource
LoadResource
SizeofResource
FindResourceA

user32

GetSystemMetrics
LoadImageA
SetWinEventHook
MessageBoxA
GetWindowThreadProcessId

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-heap-l1-1-0

free
malloc
_callnewh

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_cexit
abort
terminate

vcruntime140

__CxxFrameHandler3
__std_exception_copy
memmove
__std_exception_destroy
__CxxRegisterExceptionObject
__CxxDetectRethrow
__CxxUnregisterExceptionObject
__FrameUnwindFilter
memset
_CxxThrowException
__current_exception
__CxxQueryExceptionSize
__current_exception_context
__CxxExceptionFilter
memcpy

msvcp140

_Thrd_sleep
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
_Xtime_get_ticks
_Query_perf_counter
_Query_perf_frequency

api-ms-win-crt-math-l1-1-0

ceilf

mscoree

_CorExeMain

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.nep
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2d70db2db7d70562751b723bc2aa8348

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

vcruntime140

msvcp140

api-ms-win-crt-math-l1-1-0

mscoree

Sections

.text Size: 43KB - Virtual size: 42KB

.nep Size: 1024B - Virtual size: 688B

.rdata Size: 105KB - Virtual size: 104KB

.data Size: 1KB - Virtual size: 6KB

.pdata Size: 512B - Virtual size: 336B

.rsrc Size: 1.2MB - Virtual size: 1.2MB

.reloc Size: 512B - Virtual size: 84B

.text
Size: 43KB - Virtual size: 42KB

.nep
Size: 1024B - Virtual size: 688B

.rdata
Size: 105KB - Virtual size: 104KB

.data
Size: 1KB - Virtual size: 6KB

.pdata
Size: 512B - Virtual size: 336B

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

.reloc
Size: 512B - Virtual size: 84B