faf0386f829337d16d5eb009be26ed25a2f8d665f33bf2a4ad97e934396509cf

Sharing

Copy URL

Twitter E-mail

General

Target

faf0386f829337d16d5eb009be26ed25a2f8d665f33bf2a4ad97e934396509cf
Size

5.5MB
MD5

49b02b1c2b49a3e4b8a10e78baca7c6b
SHA1

39af9718057cb866a2ab51a3b04f0ee76f198b6c
SHA256

faf0386f829337d16d5eb009be26ed25a2f8d665f33bf2a4ad97e934396509cf
SHA512

7c6fe1f10a0b6077f22b7286f0c1d1618ab0c923e2da9c8209cf70f3e69d4e46375d975ba48fb102833c7cad347086a319621956fe966b951e7649dfdf30c1ba
SSDEEP

98304:BN4Zwkrgcc0ugzMLG3IJvjvejYdBQTbaGGecSoh34Tq:n503IjvmYdfoo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
faf0386f829337d16d5eb009be26ed25a2f8d665f33bf2a4ad97e934396509cf

Files

faf0386f829337d16d5eb009be26ed25a2f8d665f33bf2a4ad97e934396509cf
.exe windows:6 windows x86 arch:x86

f5edeae7fcfefca20a7f4292a487d45b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\workspace\nativeplayer\StellarDownload\Build\s7z.pdb

Imports

kernel32

GetPrivateProfileStringW
DeleteFileW
GetTickCount64
GetCurrentProcessId
QueryPerformanceCounter
ResetEvent
QueryPerformanceFrequency
GetSystemDirectoryW
LoadLibraryW
GetSystemInfo
GetVersionExW
GetNativeSystemInfo
CreatePipe
CreateProcessW
PeekNamedPipe
GetDiskFreeSpaceExW
GetLogicalDriveStringsW
GetDriveTypeW
CopyFileW
GetComputerNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
LoadLibraryExW
FreeLibrary
GetCommandLineW
VerSetConditionMask
VerifyVersionInfoW
GetDiskFreeSpaceW
GetTempFileNameW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetLogicalDrives
MoveFileExW
GetFileAttributesExW
SetFileAttributesW
LoadLibraryA
K32GetProcessImageFileNameW
GetProcessId
QueryFullProcessImageNameW
GetExitCodeProcess
GetLocalTime
GetFileTime
FileTimeToSystemTime
GetConsoleWindow
GetStdHandle
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
WriteConsoleA
HeapCreate
FlushInstructionCache
GetFullPathNameW
FreeResource
GetVersionExA
GetSystemTime
GetModuleHandleA
IsBadReadPtr
CompareFileTime
SetFileTime
SystemTimeToFileTime
MulDiv
GetSystemTimeAsFileTime
GetFileAttributesA
GetEnvironmentVariableA
GetModuleHandleW
GetProcessHeap
HeapDestroy
DecodePointer
HeapAlloc
FindResourceW
LoadResource
FindResourceExW
RaiseException
HeapReAlloc
LockResource
HeapSize
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
RtlCaptureStackBackTrace
OpenProcess
GetUserDefaultUILanguage
GetFileAttributesW
InitializeCriticalSectionEx
CreateMutexW
GetTempPathW
GetModuleFileNameW
WriteConsoleW
GetOEMCP
GetACP
IsValidCodePage
SetStdHandle
SetConsoleCtrlHandler
ReadConsoleW
EnumSystemLocalesW
GlobalLock
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
ExitProcess
SetEnvironmentVariableW
SystemTimeToTzSpecificLocalTime
GetFileType
GetModuleHandleExW
ResumeThread
ExitThread
GetCommandLineA
RtlUnwind
WaitForMultipleObjectsEx
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
SetProcessAffinityMask
VirtualFree
VirtualProtect
VirtualAlloc
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
CreateTimerQueue
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
CreateDirectoryExW
RemoveDirectoryW
EncodePointer
GetStringTypeW
GetCurrentThread
SwitchToThread
WaitForSingleObjectEx
DuplicateHandle
TryEnterCriticalSection
CreateHardLinkW
AreFileApisANSI
FindFirstFileExW
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
GetCurrentProcess
GlobalSize
WritePrivateProfileStringW
GetProcAddress
GetCurrentThreadId
GlobalUnlock
TerminateProcess
HeapFree
SizeofResource
WideCharToMultiByte
MultiByteToWideChar
CreateThread
lstrcatW
GetExitCodeThread
WaitForMultipleObjects
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
lstrcmpiW
FormatMessageW
FlushFileBuffers
SetFilePointerEx
GetFileInformationByHandle
SetEndOfFile
DeviceIoControl
lstrcpynW
WriteFile
GetVolumeInformationW
ReadFile
GetTickCount
FormatMessageA
lstrcpyA
GetUserDefaultLCID
OutputDebugStringW
lstrlenA
OutputDebugStringA
LocalFree
Sleep
LocalAlloc
SetLastError
SetEvent
CreateEventW
WaitForSingleObject
CreateDirectoryW
lstrlenW
GetLastError
lstrcpyW
SetCurrentDirectoryW
GetCurrentDirectoryW
FindClose
FindNextFileW
lstrcmpW
FindFirstFileW
GetFileSizeEx
CloseHandle
GetFileSize
CreateFileW
GlobalAlloc

user32

wsprintfW
HideCaret
CharNextA
SetForegroundWindow
SystemParametersInfoW
GetDesktopWindow
FindWindowW
CharNextW
GetForegroundWindow
AttachThreadInput
IsWindow
GetShellWindow
UnregisterClassW
SetCaretPos
CharLowerBuffW
MapVirtualKeyA
UpdateLayeredWindow
IsMenu
IsWindowEnabled
CreatePopupMenu
DestroyMenu
CheckMenuItem
CreateCaret
SystemParametersInfoA
UnhookWindowsHookEx
CallNextHookEx
LoadIconW
MonitorFromRect
GetMenuItemCount
PostMessageW
GetSystemMetrics
SendMessageTimeoutW
GetWindowRect
GetWindowThreadProcessId
OffsetRect
IsWindowVisible
InsertMenuW
AppendMenuW
DeleteMenu
TrackPopupMenu
GetActiveWindow
GetFocus
GetParent
DestroyIcon
SendMessageW
GetWindowPlacement
CopyRect
DrawIconEx
SetWindowPos
ScreenToClient
SetPropW
SetWindowLongW
GetPropW
CallWindowProcW
DefWindowProcW
ChangeWindowMessageFilter
DestroyWindow
GetCursorPos
MoveWindow
SetTimer
KillTimer
MessageBoxW
GetWindow
GetWindowTextW
GetDlgItem
GetClientRect
ShowWindow
FindWindowExW
IsRectEmpty
AllowSetForegroundWindow
EnumDisplayDevicesW
EnumDisplaySettingsW
WaitForInputIdle
EnumWindows
MsgWaitForMultipleObjects
PeekMessageW
TranslateMessage
DispatchMessageW
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetClipboardData
GetDC
ReleaseDC
GetMonitorInfoW
MonitorFromWindow
GetDisplayConfigBufferSizes
QueryDisplayConfig
DisplayConfigGetDeviceInfo
DisplayConfigSetDeviceInfo
GetMessageW
GetLastInputInfo
InflateRect
SetWindowRgn
LoadCursorW
DestroyCursor
SetCursor
SetWindowsHookExW
GetSysColor
GetMenuInfo
SetMenuInfo
GetMenuItemInfoW
IntersectRect
UnionRect
SetMenuContextHelpId
EnableWindow
SetActiveWindow
DrawTextW
EqualRect
PtInRect
EnableMenuItem
SetRect
ClientToScreen
LoadImageW
CreateIconFromResource
LoadBitmapW
GetIconInfo
GetKeyState
GetClassNameW
SetWindowTextW
InvalidateRect
EndPaint
BeginPaint
UpdateWindow
ReleaseCapture
SetCapture
GetCapture
IsZoomed
IsIconic
SetLayeredWindowAttributes
AnimateWindow
PostQuitMessage
TrackMouseEvent
GetWindowLongW
MapWindowPoints
CreateWindowExW
RegisterClassExW
PostThreadMessageW
SetFocus

gdi32

SetViewportOrgEx
DeleteObject
CreateRectRgn
CombineRgn
PtInRegion
GetObjectW
CreateDIBitmap
CreateRoundRectRgn
BitBlt
EnumFontsW
CreateBitmap
CreateCompatibleDC
DeleteDC
GetDeviceCaps
SetGraphicsMode
CreateFontIndirectW
CreateSolidBrush
GetClipBox
GetStockObject
Rectangle
SetBkMode
GetDCOrgEx
StretchBlt
SelectObject
ExtCreateRegion
IntersectClipRect
SelectClipRgn
SetWorldTransform
CreateDIBSection
GetCurrentObject
GetViewportOrgEx
EnumFontFamiliesExW
GetCharABCWidthsW
GetFontData
GetGlyphOutlineW
GetOutlineTextMetricsW
GetFontUnicodeRanges
GetGlyphIndicesW
GetTextExtentPointI
AddFontMemResourceEx
RemoveFontMemResourceEx
SetTextColor
SetTextAlign
GetTextMetricsW
ExtTextOutW
GetTextFaceW
GdiFlush
CreateCompatibleBitmap

comdlg32

GetOpenFileNameW

advapi32

OpenProcessToken
QueryServiceStatusEx
CloseServiceHandle
OpenServiceW
OpenSCManagerW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegGetValueW
CreateProcessAsUserW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
DuplicateTokenEx
RegQueryValueExW
GetUserNameW
RegDeleteValueW
RegDeleteKeyW
RegDeleteKeyValueW
RegCreateKeyExW
RegSetValueExW
RegEnumValueW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW

shell32

SHGetFolderPathW
SHFileOperationW
SHGetSpecialFolderPathW
ord165
CommandLineToArgvW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetFileInfoW
ShellExecuteW
ShellExecuteExW
SHChangeNotify
ord155
DragAcceptFiles
DragQueryFileW
DragFinish
ord190
SHOpenFolderAndSelectItems

ole32

CoCreateGuid
OleUninitialize
OleInitialize
CoSetProxyBlanket
CoInitializeSecurity
OleLockRunning
CLSIDFromString
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CreateBindCtx
GetHGlobalFromStream
CoTaskMemFree
IIDFromString
CoCreateInstance
CLSIDFromProgID

oleaut32

VariantInit
VariantClear
SetErrorInfo
GetErrorInfo
VariantChangeType
SysFreeString
CreateErrorInfo
SysAllocString
SysAllocStringLen
SysAllocStringByteLen
SysStringByteLen
SysStringLen

shlwapi

StrToIntExW
ord176
ord219
ord12
SHDeleteKeyW
PathRemoveFileSpecW
PathFindFileNameW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

winhttp

WinHttpSetTimeouts
WinHttpReadData
WinHttpQueryHeaders
WinHttpConnect
WinHttpAddRequestHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpQueryOption
WinHttpSetStatusCallback
WinHttpCloseHandle
WinHttpSetOption
WinHttpOpen
WinHttpCrackUrl

gdiplus

GdipCreateFromHDC
GdipImageSelectActiveFrame
GdipSaveImageToFile
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipDisposeImage
GdipSetSmoothingMode
GdipDeleteGraphics
GdipLoadImageFromFile
GdipFree
GdipAlloc
GdipDrawImageRectI
GdipGetImageWidth
GdipGetImageHeight
GdipGetImageRawFormat
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipLoadImageFromFileICM
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipBitmapLockBits
GdipBitmapUnlockBits
GdiplusStartup
GdiplusShutdown
GdipCreateBitmapFromHICON
GdipSaveImageToStream
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipGraphicsClear
GdipCloneImage

ws2_32

gethostbyname
WSAGetLastError
inet_ntoa
gethostname
getaddrinfo
inet_ntop

iphlpapi

GetAdaptersAddresses

netapi32

NetApiBufferFree
NetGetJoinInformation

dwmapi

DwmExtendFrameIntoClientArea

setupapi

SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW

dbghelp

MakeSureDirectoryPathExists

imm32

ImmCreateContext
ImmDestroyContext
ImmGetContext
ImmAssociateContext
ImmReleaseContext

usp10

ScriptFreeCache
ScriptShape
ScriptItemize

opengl32

wglGetCurrentContext
wglGetProcAddress

Sections

.text
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 913KB - Virtual size: 913KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 115KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 278KB - Virtual size: 277KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 231KB - Virtual size: 231KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f5edeae7fcfefca20a7f4292a487d45b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

version

winhttp

gdiplus

ws2_32

iphlpapi

netapi32

dwmapi

setupapi

dbghelp

imm32

usp10

opengl32

Sections

.text Size: 4.0MB - Virtual size: 4.0MB

.rdata Size: 913KB - Virtual size: 913KB

.data Size: 115KB - Virtual size: 213KB

.rsrc Size: 278KB - Virtual size: 277KB

.reloc Size: 231KB - Virtual size: 231KB

.text
Size: 4.0MB - Virtual size: 4.0MB

.rdata
Size: 913KB - Virtual size: 913KB

.data
Size: 115KB - Virtual size: 213KB

.rsrc
Size: 278KB - Virtual size: 277KB

.reloc
Size: 231KB - Virtual size: 231KB