1ea16e635c117ad2da3a90d4960d0497f4da246c3464f2cf3b1581d5f70101d6

Sharing

Copy URL Twitter E-mail

General

Target

1ea16e635c117ad2da3a90d4960d0497f4da246c3464f2cf3b1581d5f70101d6
Size

1.2MB
MD5

9c2dc1fa2276c166f63a585dd9b120c5
SHA1

d93743c55c7cf6857fdd970d7aeb3fd35739651a
SHA256

1ea16e635c117ad2da3a90d4960d0497f4da246c3464f2cf3b1581d5f70101d6
SHA512

3aaf01af1d95440b0078927a6d1ccbb17225281aac0dd90fae2810780a88931f8eaea11c9aaac1e1d948a0eb2432400865f2dc12c116ff1a444dbdb547829c31
SSDEEP

24576:md/oPaAlZZ+FlY7zVhNE+RtaQuNvqDzimvs9xyGD9FX:md/oiAHZ+YFqvki3yGDr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1ea16e635c117ad2da3a90d4960d0497f4da246c3464f2cf3b1581d5f70101d6

Files

1ea16e635c117ad2da3a90d4960d0497f4da246c3464f2cf3b1581d5f70101d6
.dll windows:6 windows x64 arch:x64

36d522d7593a84c6926cb40cbb1d9cdf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

F:\Dev\game-overlay\bin\Release\n_overlay.x64.pdb

Imports

kernel32

CloseHandle
GetLastError
VirtualQuery
MapViewOfFile
UnmapViewOfFile
GetProcAddress
OpenFileMappingA
LoadLibraryW
GetCurrentThreadId
GetModuleHandleW
OutputDebugStringA
SetEvent
WaitForSingleObject
CreateEventW
Sleep
GetCurrentProcess
GetCurrentProcessId
CreateThread
TerminateThread
GetModuleFileNameW
K32GetModuleBaseNameW
LoadLibraryA
CreateProcessA
OpenProcess
FreeLibrary
DisableThreadLibraryCalls
ReleaseMutex
OpenMutexW
WideCharToMultiByte
HeapCreate
VirtualProtect
HeapFree
Thread32Next
Thread32First
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
HeapReAlloc
HeapAlloc
HeapDestroy
GetThreadContext
FlushInstructionCache
SetThreadContext
OpenThread
VirtualFree
VirtualAlloc
GetSystemInfo
MultiByteToWideChar
CreateFileW
DeleteFileW
GetFileAttributesExW
ReadFile
SetEndOfFile
SetFilePointerEx
WriteFile
WriteConsoleW
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
ReadConsoleW
GetTimeZoneInformation
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetFileType
GetStdHandle
ExitProcess
MoveFileExW
RemoveDirectoryW
SetEnvironmentVariableW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
RtlUnwind
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
InterlockedFlushSList
RtlUnwindEx
InitializeSListHead
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
FormatMessageA
RtlPcToFileHeader
RaiseException
WakeAllConditionVariable
SleepConditionVariableSRW
IsProcessorFeaturePresent
InitOnceExecuteOnce
WaitForSingleObjectEx
InitializeConditionVariable
WakeConditionVariable
FindClose
FindFirstFileExW
FindNextFileW
GetFileInformationByHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
TerminateProcess

user32

UnhookWindowsHookEx
SetWindowsHookExW
GetClientRect
CallWindowProcW
RegisterWindowMessageW
LoadImageW
ScreenToClient
ClientToScreen
GetSystemMetrics
SetWindowPos
CallNextHookEx
SendMessageW
FindWindowA
SetWindowLongPtrW
GetWindowTextA
KillTimer
SetTimer
MsgWaitForMultipleObjectsEx
IsWindow
PostQuitMessage
CreateWindowExW
PostMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
DefRawInputProc
GetRawInputBuffer
GetRawInputData
GetCursor
GetCursorPos
SetCursor
SetCursorPos
ShowCursor
GetKeyboardState
GetAsyncKeyState
GetKeyState
GetWindowThreadProcessId
EnumWindows
GetWindowLongPtrW
GetWindowTextW
GetForegroundWindow
IsWindowVisible
DestroyWindow
CreateWindowExA
DefWindowProcW

shell32

ord165
SHGetSpecialFolderPathW

Exports

Exports

msg_hook_proc_ov

Sections

.text
Size: 993KB - Virtual size: 993KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 178KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

36d522d7593a84c6926cb40cbb1d9cdf

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

Exports

Exports

Sections

.text Size: 993KB - Virtual size: 993KB

.rdata Size: 178KB - Virtual size: 177KB

.data Size: 23KB - Virtual size: 32KB

.pdata Size: 51KB - Virtual size: 51KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 993KB - Virtual size: 993KB

.rdata
Size: 178KB - Virtual size: 177KB

.data
Size: 23KB - Virtual size: 32KB

.pdata
Size: 51KB - Virtual size: 51KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 4KB