217665e1fad72152952ba19623c31b083c3a85e8070f4a6dd8c7d89ce57b2021

Sharing

Copy URL Twitter E-mail

General

Target

217665e1fad72152952ba19623c31b083c3a85e8070f4a6dd8c7d89ce57b2021
Size

3.3MB
MD5

cdeeda8f0c00081390f67e50478e6db9
SHA1

49a6e7a3b322b06ce64cbe7b8558fc2a4a41fde6
SHA256

217665e1fad72152952ba19623c31b083c3a85e8070f4a6dd8c7d89ce57b2021
SHA512

c4c88520d7c8a1612ff3515eb6cefd31583b4afb2d80272b8fd74ba008f44a2c7974a4be358841d09a03958dcd21354e40054a726cd7c2c555415523ec0f1cf0
SSDEEP

3072:FOHpaboHvTJsdt2peoE0z6U9nygX8srbr3hFbFNC3Au1qtbj:FOH8S7Jsf28KzN9nyub7hZgsbj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
217665e1fad72152952ba19623c31b083c3a85e8070f4a6dd8c7d89ce57b2021

Files

217665e1fad72152952ba19623c31b083c3a85e8070f4a6dd8c7d89ce57b2021
.exe windows:5 windows x86 arch:x86

727b6b266cfeb0e724b4e41475d248e9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\landun\p-96e67ece98c34548b686b63261fbbb58\VNDesktop\VideoNativeDesktop\HummerSDK\Output\PdbFinal\PluginContainer.pdb

Imports

common

?GetSession@TXLog@@YAKXZ
?GetLCID@NLS@@YAKXZ
?SetBugReportFlag@TXBugReport@@YAHK@Z
?SetBugReportUin@TXBugReport@@YAXKH@Z
?ValidateBugReport@TXBugReport@@YAXXZ
?FlushLog@TXLog@@YAXXZ
?AddExtraMem@TXBugReport@@YAHKI@Z
?SaveCallStack@Misc@Util@@YAEEPAKEHK@Z
?GetString@CTXStringW@@QBEPB_WXZ
?GetCallStack@Misc@Util@@YA?AVCTXStringW@@EEPB_W@Z
?GetBuffer@CTXStringW@@QAEPA_WH@Z
?AppendFormat@CTXStringW@@QAAXPB_WZZ
??H@YA?AVCTXStringW@@PB_WABV0@@Z
??0CTXStringW@@QAE@ABV0@@Z
?Format@CTXStringW@@QAAXPB_WZZ
?GetLength@CTXStringW@@QBEHXZ
?ReleaseBuffer@CTXStringW@@QAEXH@Z
??ACTXStringW@@QBE_WH@Z
??0CTXStringW@@QAE@PB_W@Z
?Append@CTXStringW@@QAEXPB_W@Z
??YCTXStringW@@QAEAAV0@ABV0@@Z
??YCTXStringW@@QAEAAV0@PB_W@Z
??BCTXStringW@@QBEPB_WXZ
??1CTXStringW@@QAE@XZ
??4CTXStringW@@QAEAAV0@PB_W@Z
?GetExeDir@Sys@Util@@YA?AVCTXStringW@@XZ
?SafeLoadLibrary@Sys@Util@@YAPAUHINSTANCE__@@PB_W@Z
??0CTXStringW@@QAE@XZ
?InitBugReport@TXBugReport@@YAXPB_W000GGKHHKKP6GHPAUtagBugReportInfo@1@PBD200PAPAXPAKPAX@Z@Z
?DetourRemoveWrapper@Misc@Util@@YAHPAE0@Z
?DetourFunctionWrapper@Misc@Util@@YAXPAE0PAPAE@Z
?Mid@CTXStringW@@QBE?AV1@H@Z
?ReverseFind@CTXStringW@@QBEH_W@Z
??H@YA?AVCTXStringW@@ABV0@PB_W@Z
??4CTXStringW@@QAEAAV0@ABV0@@Z
?Left@CTXStringW@@QBE?AV1@H@Z
??8@YA_NABVCTXStringW@@PB_W@Z
?ClearDeadQueue@Misc@Util@@YAXXZ
?OnExitWinMain@Misc@Util@@YAXXZ
?TXLog_DoTXLogVW@@YAXPAUtagLogObj@@PB_W1PAD@Z
??8@YA_NPB_WABVCTXStringW@@@Z
??0CTXStringW@@QAE@PA_W@Z
?SetMainAndLogicThreadId@Misc@Util@@YAXKK@Z
?SetMainAndLogicMsgLoop@Misc@Util@@YAXPAVMessageLoopForUI@AsyncTask@@PAVMessageLoop@4@@Z
?MinimzeMemory@Sys@Util@@YAXXZ

processsession

??0CTXOPChannel@@QAE@XZ
?AddSink@CTXOPChannel@@QAEXPAUITXOPChanelSysSink@@@Z
?Run@CTXOPChannel@@EAEIXZ
?GetConnectCount@CTXOPChannel@@QAEIXZ
?SendReply@CTXOPChannel@@QAEHKKPBEI@Z
??1CTXOPChannel@@UAE@XZ
?Start@CTXOPChannel@@QAEHPB_W@Z
?Listen@CTXOPChannel@@QAEHXZ

wininet

InternetErrorDlg

asynctask

?Release@Lock@AsyncTask@@QAEXXZ
?Acquire@Lock@AsyncTask@@QAEXXZ
?Run@MessageLoopForUI@AsyncTask@@QAEXXZ
??1MessageLoopForUI@AsyncTask@@UAE@XZ
??0MessageLoopForUI@AsyncTask@@QAE@XZ
??1AtExitManager@AsyncTask@@QAE@XZ
??0AtExitManager@AsyncTask@@QAE@XZ
??1Thread@AsyncTask@@UAE@XZ
??0Thread@AsyncTask@@QAE@PBD@Z
?RegisterCallback@AtExitManager@AsyncTask@@SAXP6AXPAX@Z0@Z
??0Lock@AsyncTask@@QAE@XZ
??1Lock@AsyncTask@@QAE@XZ
?StartWithOptions@Thread@AsyncTask@@QAE_NABUOptions@12@@Z

kernel32

OutputDebugStringW
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
SetErrorMode
GetTickCount
SetUnhandledExceptionFilter
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetModuleFileNameW
GetProcAddress
OpenMutexW
CloseHandle
CreateMutexW
GetTempPathW
CreateDirectoryW
CreateFileW
GetCurrentProcess
TerminateProcess
GetModuleHandleExW
lstrlenW
GetLastError
SetLastError
DebugBreak
TlsGetValue
HeapAlloc
GetProcessHeap
TlsSetValue
InterlockedExchange
TlsAlloc
FreeLibrary
WriteProcessMemory
InterlockedDecrement
GetSystemDirectoryW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitializeSListHead
IsDebuggerPresent

user32

SetTimer
KillTimer
PostQuitMessage

advapi32

RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
GetUserNameW
RegCloseKey

shell32

ShellExecuteW

ole32

CoInitialize
OleUninitialize
OleInitialize
CoUninitialize
CoCreateInstance
CLSIDFromProgID

msvcp140

?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z

vcruntime140

__CxxFrameHandler3
memcmp
wcsrchr
memset
memcpy
memmove
_purecall
wcsstr
_except_handler4_common
__std_exception_copy
__std_exception_destroy
_CxxThrowException

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_register_onexit_function
_controlfp_s
_crt_atexit
_cexit
__p___wargv
__p___argc
_seh_filter_exe
_set_app_type
_invalid_parameter_noinfo_noreturn
_configure_wide_argv
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
terminate
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_wide_environment

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-string-l1-1-0

strlen
wcscmp
wcscpy_s
wcslen

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode
__stdio_common_vswscanf

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
_set_new_mode
free

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 66KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

727b6b266cfeb0e724b4e41475d248e9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

common

processsession

wininet

asynctask

kernel32

user32

advapi32

shell32

ole32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 17KB - Virtual size: 17KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 512B - Virtual size: 1KB

.gfids Size: 512B - Virtual size: 80B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 66KB - Virtual size: 68KB

.text
Size: 17KB - Virtual size: 17KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 512B - Virtual size: 1KB

.gfids
Size: 512B - Virtual size: 80B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 66KB - Virtual size: 68KB