8f4af99e9d027198b55f169ce1b5e01e

Sharing

Copy URL

Twitter E-mail

General

Target

8f4af99e9d027198b55f169ce1b5e01e
Size

347KB
MD5

8f4af99e9d027198b55f169ce1b5e01e
SHA1

56a9bad134a38aa5fa9d3b75b6cf6ff56c6b58d5
SHA256

e9bd7c6dfd541c95293d83a88e516f1f5a0ad0ecbc94e43423bf69fe9e58c4cd
SHA512

4f1c8723f123c699302bfee7e473c77ba437d3a58d682e9e2b1242b37cce92960a2cedb36e1dd5fd6aef4af221420d5c9ab6b50b5be8653adaae37bb40ba5226
SSDEEP

6144:3XoaGfp1fJvMwzWdb847wjOTZDUwrlmpSOtYCWqU6Nr+IgYsCpTKMdb1oe3:3XZUv6wf47wjOTmwrVbuyI5ldb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8f4af99e9d027198b55f169ce1b5e01e

Files

8f4af99e9d027198b55f169ce1b5e01e
.dll windows:5 windows x86 arch:x86

044223c60de87a35ab9297650cf6ffdf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\build\source\rpwmplyr\rel32\rpwmplyr.pdb

Imports

ole32

OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
StringFromGUID2
StringFromCLSID
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoInitialize
CoCreateInstance
CoUninitialize

advapi32

RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegEnumKeyExA
RegQueryInfoKeyA

user32

RemovePropA
CallNextHookEx
UnhookWindowsHookEx
RegisterWindowMessageA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
CreateAcceleratorTableA
RegisterClassExA
LoadCursorA
GetClassInfoExA
GetDesktopWindow
SetFocus
GetFocus
GetWindow
DestroyAcceleratorTable
SetWindowsHookExA
EndPaint
FillRect
ReleaseCapture
GetClassNameA
IsChild
SetCapture
RedrawWindow
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
MoveWindow
GetSysColor
GetClientRect
SetPropA
GetClassInfoA
PostThreadMessageA
GetMessageA
DispatchMessageA
PeekMessageA
GetSystemMetrics
CharPrevA
BeginPaint
CallWindowProcA
CharNextA
FindWindowExA
GetWindowThreadProcessId
GetActiveWindow
GetParent
EnableWindow
SetWindowPos
ShowWindow
SendMessageA
GetDlgItem
PostMessageA
RegisterClassA
CreateWindowExA
GetWindowLongA
DefWindowProcA
IsWindow
SetWindowLongA
DestroyWindow
UnregisterClassA
KillTimer
SetTimer
SetLastErrorEx
LoadStringA

msvcr90

??_V@YAXPAX@Z
_resetstkoflw
strncpy_s
_recalloc
calloc
sprintf_s
_strlwr
atof
wcstoul
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
_invalid_parameter_noinfo
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
strrchr
strchr
realloc
_ismbcspace
atol
_vsnprintf
memmove
strncmp
_beginthreadex
_stricmp
printf
??_U@YAPAXI@Z
toupper
_time32
strtok
_strdup
isspace
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_except_handler4_common
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
strncpy
memset
free
malloc
??2@YAPAXI@Z
??3@YAXPAX@Z
_purecall
strstr
sprintf
atoi
fopen
fclose
__CxxFrameHandler3
memcpy_s
memcpy
_strnicmp
_putenv
isdigit
vfprintf

kernel32

GetCurrentProcessId
GetLastError
GetCurrentProcess
GetProcAddress
lstrcmpiA
IsDBCSLeadByte
GetModuleFileNameA
lstrcmpA
MulDiv
FlushInstructionCache
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
GetVersionExA
IsBadReadPtr
VirtualProtect
VirtualQuery
IsBadWritePtr
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
LoadLibraryA
CreateEventA
ResetEvent
SetEvent
TryEnterCriticalSection
WaitForSingleObject
Sleep
GetThreadPriority
SetThreadPriority
ResumeThread
SuspendThread
CloseHandle
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
FreeLibrary
SetLastError
GetCurrentThreadId
GlobalAlloc
GlobalLock
EnterCriticalSection
RaiseException
MultiByteToWideChar
lstrlenA
GlobalUnlock
GetLocaleInfoA
lstrlenW
WideCharToMultiByte
GetModuleHandleA
SetErrorMode
InterlockedDecrement
InterlockedIncrement
DisableThreadLibraryCalls

oleaut32

VariantClear
VarBstrCmp
OleCreateFontIndirect
LoadTypeLi
LoadRegTypeLi
DispCallFunc
VariantInit
VarUI4FromStr
SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen

gdi32

GetStockObject
GetObjectA
CreateSolidBrush
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
SelectObject
DeleteObject
GetDeviceCaps

msvcp90

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

Exports

Exports

RMACreateInstance
RMAShutdown
SetDLLAccessPath

Sections

.text
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

044223c60de87a35ab9297650cf6ffdf

Headers

File Characteristics

PDB Paths

Imports

ole32

advapi32

user32

msvcr90

kernel32

oleaut32

gdi32

msvcp90

Exports

Exports

Sections

.text Size: 164KB - Virtual size: 164KB

.rdata Size: 49KB - Virtual size: 48KB

.data Size: 12KB - Virtual size: 13KB

.rsrc Size: 100KB - Virtual size: 99KB

.reloc Size: 20KB - Virtual size: 20KB

.text
Size: 164KB - Virtual size: 164KB

.rdata
Size: 49KB - Virtual size: 48KB

.data
Size: 12KB - Virtual size: 13KB

.rsrc
Size: 100KB - Virtual size: 99KB

.reloc
Size: 20KB - Virtual size: 20KB