9a4f0d511e4b97451408cc30cc168bc4f4df0dba4b033ab9f672bdf106cc8630

Sharing

Copy URL Twitter E-mail

General

Target

9a4f0d511e4b97451408cc30cc168bc4f4df0dba4b033ab9f672bdf106cc8630
Size

2.6MB
MD5

f2f6a842c54e4f4c2d4d07eb91482b62
SHA1

079a9e34121b274426f43acb8679d0f69f9e4f2e
SHA256

9a4f0d511e4b97451408cc30cc168bc4f4df0dba4b033ab9f672bdf106cc8630
SHA512

60516945442af33d76a1bb8d9f6dc5a2525d8805294521c8c435a5c99cbc7f3b8c4323163fd6b75ced4c258cb38fef73fe5a7e60d9c2051fcfa4396c7b00ecf2
SSDEEP

49152:tmboNHM3yAYTx/jP/WuNbSQp29E0nWazB7Ku0GaXO94IBAUZLYj76:KyXNj2uhpePJtBAUZL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9a4f0d511e4b97451408cc30cc168bc4f4df0dba4b033ab9f672bdf106cc8630

Files

9a4f0d511e4b97451408cc30cc168bc4f4df0dba4b033ab9f672bdf106cc8630
.exe windows:5 windows x86 arch:x86

18fff8563e5e578f8423cdd9e6e82f0e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\Code\Audit\InsideSrc\0801106204_proto_changed\target\release\symbols\Client\RzxClient.pdb

Imports

dsound

ord12
ord7

lame

ord1
ord6
ord4
ord14
ord24
ord41
ord154
ord148
ord163
ord22
ord139
ord164

netapi32

Netbios

setupapi

SetupDiEnumDeviceInfo
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList

psapi

EnumProcesses
EnumProcessModules
GetModuleFileNameExA

ws2_32

WSAStartup
WSASetLastError
gethostbyaddr
getservbyname
WSASocketA
WSAGetLastError
gethostname
gethostbyname
htonl
ntohs
WSAWaitForMultipleEvents
WSASendTo
WSACleanup
select
setsockopt
listen
bind
getsockname
inet_ntoa
socket
htons
inet_addr
connect
closesocket
send
recv
WSAEventSelect
WSASend
ntohl
WSACloseEvent
WSARecvFrom
WSARecv
WSASetEvent
WSAEnumNetworkEvents
WSACreateEvent
getsockopt
ioctlsocket
shutdown
__WSAFDIsSet
getpeername
accept
WSAResetEvent

gdi32

GetStockObject
StretchBlt
CreateCompatibleDC
DeleteObject
DeleteDC
GetObjectA
CreateCompatibleBitmap
GetDIBits
SelectObject

gdiplus

GdipFree
GdipAlloc
GdipLoadImageFromFile
GdipDisposeImage
GdipSaveImageToFile
GdipGetImageWidth
GdipGetImageThumbnail
GdipCloneImage
GdiplusStartup
GdiplusShutdown
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipGetImageHeight

ntdll

ZwQuerySystemInformation
NtClose
ZwQueryInformationFile
NtFreeVirtualMemory
NtAllocateVirtualMemory
RtlConvertSidToUnicodeString
NtQuerySecurityObject
NtTerminateThread
NtOpenKey
NtQuerySystemInformation
NtQueryInformationThread
NtOpenSymbolicLinkObject
NtSetInformationFile
NtQuerySymbolicLinkObject
NtQueryInformationProcess
NtWaitForSingleObject
NtReadVirtualMemory
NtOpenProcessToken
NtQueryVirtualMemory
NtQueryInformationToken
NtSetSecurityObject
NtOpenProcess
NtDuplicateObject
NtSetEvent
NtCreateEvent
NtQueryObject
RtlInitializeSListHead
RtlFreeHeap
RtlMultiByteToUnicodeSize
RtlInterlockedPopEntrySList
RtlInterlockedPushEntrySList
RtlAllocateHeap
RtlRaiseStatus
RtlMultiByteToUnicodeN
RtlUpcaseUnicodeChar
RtlCreateHeap
RtlGetVersion
NtDeviceIoControlFile
RtlUnwind
NtCreateKeyedEvent
NtWaitForKeyedEvent
NtReleaseKeyedEvent
RtlStringFromGUID
RtlFreeUnicodeString
NtQueryValueKey
NtReleaseSemaphore
NtCreateSemaphore
NtWriteFile

kernel32

FileTimeToLocalFileTime
FindFirstFileExA
MoveFileA
GetDriveTypeW
FindFirstFileExW
GetTimeZoneInformation
SetConsoleCtrlHandler
HeapSetInformation
GetStartupInfoW
GetCPInfo
GetStringTypeW
IsProcessorFeaturePresent
RaiseException
IsDebuggerPresent
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
EncodePointer
TlsFree
GetStdHandle
SetHandleCount
GetFileType
GetOEMCP
IsValidCodePage
LCMapStringW
PeekNamedPipe
GetCurrentDirectoryW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
DecodePointer
GetLocaleInfoW
UnhandledExceptionFilter
GetDateFormatA
GetTimeFormatA
GetLocaleInfoA
TlsAlloc
TlsSetValue
TlsGetValue
lstrcmpW
GetVolumeInformationA
lstrcpynA
lstrlenA
IsBadWritePtr
GetACP
SetErrorMode
SetUnhandledExceptionFilter
CreateIoCompletionPort
GetQueuedCompletionStatus
ReadDirectoryChangesW
PostQueuedCompletionStatus
CancelIo
ReleaseSemaphore
OpenSemaphoreA
CreateSemaphoreA
GetFileInformationByHandle
GetWindowsDirectoryA
GetExitCodeThread
GetCommandLineA
GetExitCodeProcess
Module32Next
TerminateProcess
VirtualFreeEx
ReadProcessMemory
FlushInstructionCache
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
CopyFileA
MoveFileExA
RemoveDirectoryA
CreateDirectoryA
OpenEventA
SetProcessWorkingSetSize
ExitProcess
GetModuleFileNameW
OpenMutexA
InterlockedExchange
GetCurrentDirectoryA
SetCurrentDirectoryA
InterlockedIncrement
InterlockedDecrement
WTSGetActiveConsoleSessionId
InitializeCriticalSection
CloseHandle
WriteFile
CreateFileA
ReadFile
SetFilePointer
GetFileSize
GetLastError
Sleep
SetFileTime
FindClose
FindFirstFileA
GetProcAddress
GetModuleHandleA
WaitForSingleObject
CreateProcessA
OutputDebugStringA
CreateMutexA
GetLocalTime
ReleaseMutex
GetFileAttributesExA
FlushFileBuffers
SetEndOfFile
LoadLibraryA
GetSystemDirectoryA
FreeLibrary
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
UnmapViewOfFile
GetTickCount
SetFileAttributesA
GetFileAttributesA
GetDiskFreeSpaceExA
GetDriveTypeA
GetLogicalDriveStringsA
GetLogicalDrives
GetModuleFileNameA
GetPrivateProfileStringA
WritePrivateProfileStringA
FlushViewOfFile
GetCurrentThreadId
SetLastError
GetComputerNameA
CreateThread
GetTempPathA
CreateEventA
SetEvent
ResetEvent
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
LoadLibraryW
GetModuleHandleW
OpenProcess
WideCharToMultiByte
Module32First
CreateToolhelp32Snapshot
Process32Next
Process32First
GetTempPathW
MultiByteToWideChar
CopyFileW
GetTempFileNameW
MoveFileExW
TerminateThread
FindResourceA
QueryPerformanceCounter
GetFullPathNameA
DuplicateHandle
GetCurrentProcess
LocalFree
FileTimeToSystemTime
FindNextFileA
GetProcessHeap
OutputDebugStringW
UnlockFileEx
UnlockFile
SystemTimeToFileTime
LockFileEx
LockFile
HeapValidate
HeapSize
HeapReAlloc
HeapFree
HeapDestroy
HeapCreate
HeapAlloc
GetVersionExA
GetSystemTimeAsFileTime
GetSystemTime
GetSystemInfo
GetFullPathNameW
GetFileAttributesExW
GetFileAttributesW
GetDiskFreeSpaceW
GetDiskFreeSpaceA
GetCurrentProcessId
FormatMessageW
FormatMessageA
DeleteFileW
DeleteFileA
CreateMutexW
CreateFileMappingW
CreateFileW
AreFileApisANSI
DeleteCriticalSection
InterlockedCompareExchange
EnterCriticalSection
LeaveCriticalSection

user32

EnumChildWindows
GetDesktopWindow
FindWindowA
SendMessageA
RegisterShellHookWindow
SetWindowLongA
GetMessageA
TranslateMessage
DispatchMessageA
LoadCursorA
RegisterClassExA
ReleaseDC
GetSystemMetrics
GetDC
MsgWaitForMultipleObjects
GetWindowTextA
GetClassNameA
EnumWindows
IsWindowVisible
FindWindowExA
GetWindowThreadProcessId
GetForegroundWindow
RegisterWindowMessageA
ShowWindow
CreateWindowExA
DefWindowProcA
PostMessageA

advapi32

OpenSCManagerA
OpenServiceA
ChangeServiceConfigA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegSetValueExA
RegOpenKeyA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
ImpersonateLoggedOnUser
RevertToSelf
RegDeleteValueA
RegEnumKeyExA
ConvertStringSecurityDescriptorToSecurityDescriptorA
SetFileSecurityA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA
CreateProcessAsUserA
SetTokenInformation
GetTokenInformation
DuplicateTokenEx
RegCreateKeyExA
RegFlushKey
StartServiceA
CloseServiceHandle
LsaOpenPolicy
LsaLookupSids
LsaFreeMemory
LsaClose
CreateServiceA

shell32

SHGetFolderPathA

ole32

CoCreateGuid
CoInitializeEx
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

SysAllocString
SysStringLen
SysFreeString
VariantClear

iphlpapi

GetPerAdapterInfo
GetAdaptersInfo

winmm

waveInAddBuffer
waveInUnprepareHeader
waveInStart
waveInStop
waveInOpen
waveInClose
mmioOpenA
mmioClose
mmioDescend
mmioWrite
mmioAdvance
mmioSetInfo
mmioRead
mmioSeek
mmioCreateChunk
mmioGetInfo
waveInPrepareHeader
mmioAscend

wininet

InternetOpenA
InternetCloseHandle
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetConnectA

wtsapi32

WTSQueryUserToken

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

mswsock

AcceptEx

Exports

Exports

?AnalyseInitialize@@YG_NXZ
?GetGameAccountFromProcess@@YG_NP6GHPAU_ANALYSER_PROCESS_GAME@@@Z@Z
?GetRunningBrowserFromProcessList@@YG_NPAU_BROWSER_INFO@@@Z
?ftplib_debug@@3HA
FtpAccess
FtpCDUp
FtpChdir
FtpClearCallback
FtpClose
FtpDelete
FtpDir
FtpGet
FtpGetFered
FtpGetResponseCode
FtpLastResponse
FtpMkdir
FtpModDate
FtpNlst
FtpPut
FtpPwd
FtpRead
FtpRename
FtpRmdir
FtpSetCallback
FtpSite
FtpSize
FtpSysType
FtpWrite
_getAccount@0

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1007KB - Virtual size: 1007KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

18fff8563e5e578f8423cdd9e6e82f0e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

dsound

lame

netapi32

setupapi

psapi

ws2_32

gdi32

gdiplus

ntdll

kernel32

user32

advapi32

shell32

ole32

oleaut32

iphlpapi

winmm

wininet

wtsapi32

version

mswsock

Exports

Exports

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 1007KB - Virtual size: 1007KB

.data Size: 23KB - Virtual size: 62KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 83KB - Virtual size: 83KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 1007KB - Virtual size: 1007KB

.data
Size: 23KB - Virtual size: 62KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 83KB - Virtual size: 83KB