bad4ae1d0084eaa341a0601d7af0faa0

Sharing

Copy URL Twitter E-mail

General

Target

bad4ae1d0084eaa341a0601d7af0faa0
Size

1.3MB
MD5

bad4ae1d0084eaa341a0601d7af0faa0
SHA1

8225874717cdadbadfed2bd0121ae2ffa9760e7b
SHA256

e6b6f1c660fa6bb33c9e9b589c6a7bb09daea961e29431800dfeb8b0dc6faee5
SHA512

42f1022316a93e4e3b2ac7de753dcd9c5c7073481d4fc2b4e6286e8ff8a01237dfb9ee4989dbd953c993a02d4482c9ebd136f0a8190037fe23cd5780553337f5
SSDEEP

24576:Ov0Y+ewJmvI/cZqglyVLC68XNa4xc1rmw8/VkTq4kdiw5lQcC/6Ul3F4GD:xEYcZq/+xNa4xWmw86mhlZC/6Ul3F4GD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bad4ae1d0084eaa341a0601d7af0faa0

Files

bad4ae1d0084eaa341a0601d7af0faa0
.exe windows:4 windows x86 arch:x86

0f6018ed14f28ec4543634e0a8fe8362

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Src\realarcadelegacy\Wrapper\app\Release\WrapperApp.pdb

Imports

winmm

PlaySoundA
timeGetTime

shlwapi

SHDeleteKeyA

setupapi

SetupIterateCabinetA

kernel32

SetFilePointer
FindFirstFileA
GetFileAttributesA
DeleteFileA
GetCurrentDirectoryA
GetLastError
WideCharToMultiByte
GetPrivateProfileStringA
GetPrivateProfileIntA
CopyFileA
EnterCriticalSection
LeaveCriticalSection
InterlockedExchange
GetACP
GetLocaleInfoA
GetVersionExA
RaiseException
GetVolumeInformationA
GetSystemDirectoryA
CloseHandle
OpenSemaphoreA
OutputDebugStringA
SetFileAttributesA
CreateEventA
WaitForSingleObject
SetEvent
CreateThread
GetCurrentThreadId
GetExitCodeProcess
CreateProcessA
GetModuleHandleA
CreateFileA
FindClose
GetDateFormatA
SystemTimeToTzSpecificLocalTime
IsBadWritePtr
GetSystemTime
Sleep
GlobalFree
GlobalReAlloc
GlobalUnlock
GlobalLock
GlobalAlloc
EnumSystemLocalesA
ReadFile
EnumResourceNamesA
InitializeCriticalSection
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
GetSystemInfo
VirtualProtect
VirtualQuery
GetOEMCP
HeapSize
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
FlushFileBuffers
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
GetCurrentProcess
SetUnhandledExceptionFilter
TlsGetValue
TlsSetValue
TlsFree
GetTimeZoneInformation
SetLastError
TlsAlloc
GetCPInfo
LCMapStringW
LCMapStringA
IsBadReadPtr
HeapAlloc
ExitProcess
HeapFree
GetCommandLineA
GetStartupInfoA
RtlUnwind
WriteFile
lstrlenA
GetModuleFileNameA
TerminateProcess
LoadLibraryA
GetProcAddress
FreeLibrary
SetCurrentDirectoryA
GetLogicalDrives
InterlockedDecrement
InterlockedIncrement
IsValidLocale
IsValidCodePage
FileTimeToSystemTime
IsBadCodePtr
SetStdHandle
GetLocaleInfoW
DeleteCriticalSection
FileTimeToLocalFileTime
GetDriveTypeA
GetFullPathNameA
LocalFree
MultiByteToWideChar
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
CompareStringA

user32

RegisterClassExA
GetWindowLongA
DefWindowProcA
CreateWindowExA
ReleaseCapture
ClientToScreen
SetCapture
BeginPaint
InvalidateRect
SetCursor
PtInRect
MoveWindow
LoadIconA
UpdateWindow
ShowWindow
SetFocus
SendMessageA
SetWindowRgn
EnumChildWindows
GetClassNameA
GetWindowRect
SetWindowPos
LoadBitmapA
GetClientRect
KillTimer
SetTimer
GetMessageA
TranslateMessage
DispatchMessageA
LoadCursorA
CopyIcon
SetSystemCursor
PostThreadMessageA
MessageBoxA
EnumDisplaySettingsA
ChangeDisplaySettingsA
IsWindow
PostQuitMessage
PostMessageA
SetWindowLongA
LoadStringA
GetParent
FindWindowA
SetRect
SystemParametersInfoA
EndPaint

gdi32

ExtCreateRegion
CreateCompatibleDC
DeleteDC
StretchBlt
SelectObject
BitBlt
CreateRectRgn
OffsetRgn
CombineRgn
GetObjectA
DeleteObject
CreateDIBSection

advapi32

RegOpenKeyA
RegCreateKeyA
RegDeleteValueA
RegQueryInfoKeyA
RegEnumValueA
RegCreateKeyExA
RegDeleteKeyA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

ole32

CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

SysFreeString
SysAllocStringLen
SysStringLen
VariantInit
VariantClear
VariantChangeType
SysAllocString
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantCopy
SysAllocStringByteLen
SysStringByteLen

Sections

.text
Size: 220KB - Virtual size: 219KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1004KB - Virtual size: 1011KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0f6018ed14f28ec4543634e0a8fe8362

Headers

File Characteristics

PDB Paths

Imports

winmm

shlwapi

setupapi

kernel32

user32

gdi32

advapi32

ole32

oleaut32

Sections

.text Size: 220KB - Virtual size: 219KB

.rdata Size: 48KB - Virtual size: 44KB

.data Size: 8KB - Virtual size: 14KB

.rsrc Size: 1004KB - Virtual size: 1011KB

.text
Size: 220KB - Virtual size: 219KB

.rdata
Size: 48KB - Virtual size: 44KB

.data
Size: 8KB - Virtual size: 14KB

.rsrc
Size: 1004KB - Virtual size: 1011KB