xy_extractor_reworked[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

xy_extractor_reworked.exe
Size

42.5MB
MD5

88f3cdf8511fd4a6b2e6ee66dae18b8b
SHA1

4d06020e75e1c43dab3d77c5e746d8980dd9abce
SHA256

465924f22a3ead24526ad964eaafee9928fa49cb6124353d016f12d52b8e9521
SHA512

468c479f4a64fccc0476872e4a1b14d65a10470bf7acb85c73dbb32ba765523d35d47b7accc3374660515adb98d3e5d3f31a2bd08d96916d3e79115d3986db88
SSDEEP

786432:c3Ck7fkuTe2U4SjRIe164PnBH8UPROoBk0MLvne:GC08u62U4oV6IBcYRw0Mj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
xy_extractor_reworked.exe

Files

xy_extractor_reworked.exe
.exe windows:6 windows x64 arch:x64

6a34896ee8f26868a104f7bdca46cfe8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

WakeAllConditionVariable
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

ScreenToClient

gdi32

CreateRoundRectRgn

advapi32

RegGetValueA

ole32

CoInitializeSecurity

oleaut32

SysFreeString

d3dcompiler_43

D3DCompile

msvcp140

??7ios_base@std@@QEBA_NXZ

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

winhttp

WinHttpSendRequest

imm32

ImmSetCompositionWindow

normaliz

IdnToAscii

wldap32

ord301

crypt32

CertFindExtension

ws2_32

closesocket

rpcrt4

UuidToStringA

psapi

GetModuleInformation

vcruntime140_1

__CxxFrameHandler4

vcruntime140

longjmp

api-ms-win-crt-stdio-l1-1-0

_fseeki64

api-ms-win-crt-utility-l1-1-0

srand

api-ms-win-crt-string-l1-1-0

_strdup

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-time-l1-1-0

_difftime64

api-ms-win-crt-math-l1-1-0

ceilf

api-ms-win-crt-filesystem-l1-1-0

_unlink

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

Sections

.text
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 307KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 5.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.5'i
Size: - Virtual size: 22.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.oLM
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.v_?
Size: 42.5MB - Virtual size: 42.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6a34896ee8f26868a104f7bdca46cfe8

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

d3dcompiler_43

msvcp140

d3d11

d3dx11_43

winhttp

imm32

normaliz

wldap32

crypt32

ws2_32

rpcrt4

psapi

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: - Virtual size: 1.2MB

.rdata Size: - Virtual size: 307KB

.data Size: - Virtual size: 5.6MB

.pdata Size: - Virtual size: 52KB

.5'i Size: - Virtual size: 22.6MB

.oLM Size: 5KB - Virtual size: 5KB

.v_? Size: 42.5MB - Virtual size: 42.5MB

.rsrc Size: 512B - Virtual size: 469B

.text
Size: - Virtual size: 1.2MB

.rdata
Size: - Virtual size: 307KB

.data
Size: - Virtual size: 5.6MB

.pdata
Size: - Virtual size: 52KB

.5'i
Size: - Virtual size: 22.6MB

.oLM
Size: 5KB - Virtual size: 5KB

.v_?
Size: 42.5MB - Virtual size: 42.5MB

.rsrc
Size: 512B - Virtual size: 469B