7f16926ff679f94e27f4e58c9d375868

Sharing

Copy URL Twitter E-mail

General

Target

7f16926ff679f94e27f4e58c9d375868
Size

1.4MB
MD5

7f16926ff679f94e27f4e58c9d375868
SHA1

9a6f2a0f34bcf4b417d4d4e5aa7c3be24559b89f
SHA256

0a7bce1bf45a21fdb97b930b3a5195eba8ab97a5bb7e26aa34bef47141a09928
SHA512

63ff8c13a5b7caa39ba7d679e63f445066bfed58cd7f79dd5aefa4adcc60dfca8058545b988b4841598ff90d051b2424139353aa6fcb5347111d57c1f498c61b
SSDEEP

24576:Mk+ZZZZVdjD2CP/bjX/SFUfj391JtfDVSn1P8+ibm:wldX2CPn6ete1P

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7f16926ff679f94e27f4e58c9d375868

Files

7f16926ff679f94e27f4e58c9d375868
.dll windows:5 windows x86 arch:x86

ad67f7a313b35800adcb6aa8dd978380

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Mes Documents\Base D3D\ZicoS77 Base Public\xBase\[Working Full] N4n033 Public Hack Base\Debug\N4n033 New Base.pdb

Imports

kernel32

GetPrivateProfileIntA
WritePrivateProfileStringA
MulDiv
GetProcAddress
DisableThreadLibraryCalls
CreateThread
ExitProcess
Sleep
VirtualProtect
GetModuleHandleA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
FreeLibrary
VirtualQuery
GetModuleFileNameW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
lstrlenA
DebugBreak
RaiseException
IsDebuggerPresent
HeapFree
GetProcessHeap
HeapAlloc
lstrcmpiA
GetFullPathNameA
LeaveCriticalSection
DeleteCriticalSection
InterlockedCompareExchange
InitializeCriticalSection
InterlockedExchange
EnterCriticalSection
FindResourceW
FindResourceA
SizeofResource
LoadResource
LockResource
UnmapViewOfFile
CloseHandle
CreateFileW
CreateFileA
CreateFileMappingA
GetFileSize
MapViewOfFile
GetLastError
WriteFile
OutputDebugStringA
VirtualAlloc
VirtualFree
WideCharToMultiByte
MultiByteToWideChar
IsProcessorFeaturePresent
GetSystemInfo
GetVersionExA
LoadLibraryA

user32

FindWindowW
GetCursorPos
GetForegroundWindow
ScreenToClient
GetSystemMetrics
SetRect
GetKeyState
FindWindowA
MapVirtualKeyW
GetAsyncKeyState
wsprintfA

gdi32

CreateCompatibleDC
CreateDIBSection
GetGlyphOutlineA
GetDeviceCaps
CreateFontW
SelectObject
SetTextColor
GetTextMetricsA
GetObjectW
SetMapMode
MoveToEx
ExtTextOutA
CreateFontIndirectW
CreateFontIndirectA
GetFontLanguageInfo
GetTextMetricsW
SetBkMode
GetCharacterPlacementW
GetCharacterPlacementA
DeleteDC
DeleteObject
ExtTextOutW
GetTextExtentPoint32W
SetTextAlign
SetBkColor
GetObjectA

shell32

ShellExecuteA

msvcr90d

isalnum
isalpha
isxdigit
toupper
atoi
memmove
qsort
tolower
strchr
fread
fseek
fwrite
fclose
tmpfile
_fpclass
_CItanh
_CIsinh
_CIfmod
_CIexp
_CIcosh
_CRT_RTC_INITW
_encode_pointer
_malloc_dbg
_free_dbg
_encoded_null
_decode_pointer
_CrtSetCheckCount
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
_except_handler4_common
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
atof
_stricmp
_snprintf
_CIasin
floor
setlocale
_strdup
ldexp
_strtime
_strdate
frexp
sscanf
_vsnprintf
isspace
isdigit
_setjmp3
longjmp
_controlfp
_except_handler3
modf
iswspace
iswalpha
iswdigit
iswpunct
__CxxFrameHandler
strncpy
_CIpow
_ftol
_finite
_CIacos
free
ceil
memset
wcsncpy
memcmp
exit
malloc
__CxxFrameHandler3
??2@YAPAXI@Z
??3@YAXPAX@Z
clock
_time64
_localtime64
sprintf
atan
sin
atan2
sqrt
strcpy
memcpy
strlen
_isnan

advapi32

RegQueryValueExA
RegOpenKeyA
RegCloseKey

Sections

.textbss
Size: - Virtual size: 552KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_TEXT
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 66KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 692B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ad67f7a313b35800adcb6aa8dd978380

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

msvcr90d

advapi32

Sections

.textbss Size: - Virtual size: 552KB

_TEXT Size: 30KB - Virtual size: 29KB

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 134KB - Virtual size: 134KB

.data Size: 66KB - Virtual size: 94KB

.idata Size: 6KB - Virtual size: 5KB

.rsrc Size: 1024B - Virtual size: 692B

.reloc Size: 38KB - Virtual size: 38KB

.textbss
Size: - Virtual size: 552KB

_TEXT
Size: 30KB - Virtual size: 29KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 134KB - Virtual size: 134KB

.data
Size: 66KB - Virtual size: 94KB

.idata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 1024B - Virtual size: 692B

.reloc
Size: 38KB - Virtual size: 38KB