2d09a59e7d041824d4fa62ca6080d6d1efb20efdbf369061b8aba215b9341604

Sharing

Copy URL Twitter E-mail

General

Target

2d09a59e7d041824d4fa62ca6080d6d1efb20efdbf369061b8aba215b9341604
Size

1.3MB
MD5

029aac49b9424a8b0fe0d778a9106221
SHA1

8f9f5c73944f22562d55a9a7cc2fbf4e5d299309
SHA256

2d09a59e7d041824d4fa62ca6080d6d1efb20efdbf369061b8aba215b9341604
SHA512

170cf0a0c29effbeaa8b600cb41d51d3f9902a8f4c36d0977c48eb5a4aeaf34b7dbe8a10105ab677849b3b7c71ceadd4f37bdd30ff6bea2b57c6fdec836f4f5b
SSDEEP

24576:KhVhLtzLNiprTx3cpcYjqkDQ1fLzc/fVn/N:OVhLtGrT2jQ1fLzc/fVn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2d09a59e7d041824d4fa62ca6080d6d1efb20efdbf369061b8aba215b9341604

Files

2d09a59e7d041824d4fa62ca6080d6d1efb20efdbf369061b8aba215b9341604
.dll windows:6 windows x64 arch:x64

f897e4877bdf914ae18c502a00081810

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Develope\Unity\Pencil_4-Unity-PackageManagerDeploy\Pencil_4-Unity\Pencil4NativeDLL\Pencil4NativeDLL\x64\Release(Standalone)\Pcl4NativePlugin.pdb

Imports

oleaut32

SysAllocString

netapi32

Netbios

iphlpapi

GetAdaptersInfo

rpcrt4

UuidCreate
UuidToStringW
UuidFromStringW
RpcStringFreeW

winmm

timeGetTime

shlwapi

SHCreateStreamOnFileW
PathCombineW
PathAddBackslashA
PathRemoveFileSpecW

xmllite

CreateXmlReader

kernel32

GetSystemDirectoryA
GetVolumeInformationA
CreateFileW
ReadFile
WriteFile
CloseHandle
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
GetModuleHandleW
GetProcAddress
FindClose
FindFirstFileW
FindNextFileW
GetTempPathW
GetLocalTime
FileTimeToSystemTime
MultiByteToWideChar
WideCharToMultiByte
GetVolumeInformationW
GetSystemDirectoryW
GetFileTime
DecodePointer
RaiseException
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
DeleteCriticalSection
OutputDebugStringW
LocalFree
FormatMessageW
ReleaseMutex
WaitForSingleObject
CreateMutexW
OutputDebugStringA
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
QueryPerformanceCounter
QueryPerformanceFrequency
DuplicateHandle
WaitForSingleObjectEx
Sleep
GetCurrentProcess
GetCurrentThread
GetExitCodeThread
GetNativeSystemInfo
RtlPcToFileHeader
EncodePointer
QueueUserWorkItem
IsProcessorFeaturePresent
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
SetEvent
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
RtlUnwindEx
ExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
GetACP
GetStdHandle
GetFileType
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStringTypeW
GetTimeZoneInformation
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
ReadConsoleW
SetEndOfFile
InitializeSListHead

advapi32

RegCloseKey
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetFileSecurityW
InitializeSecurityDescriptor
InitializeAcl
GetSecurityDescriptorDacl
GetSecurityDescriptorControl
GetLengthSid
GetFileSecurityW
GetAclInformation
GetAce
FreeSid
EqualSid
AllocateAndInitializeSid
AddAce

shell32

SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHGetSpecialFolderLocation
SHGetPathFromIDListW

ole32

CoCreateInstance

Exports

Exports

AllocPcl4LineEffectHandle
BeginLineEffectProcess
CreateBrushPreview
CreateStrokePreview
EndLineEffectProcess
FreePcl4LineEffectHandle
GetCommitHash
GetTextureUpdateCallback
GetTextureUpdateCallbackV2
Pcl4GetLicenseProductId
Pcl4GetLicenseRemainingTrialDays
Pcl4GetLicenseState
Pcl4LicenseAllowedAsTrialVersion
Pcl4LicenseGetMode
Pcl4LicenseInitialize
Pcl4LicenseUninitialize
Pcl4LineEffectAsync
Pcl4LineEffectWait
Pcl4RefreshLicense
RasterBytesPerPixel
RequestTextureUpdate
WaitWhileBusy

Sections

.text
Size: 848KB - Virtual size: 847KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 412KB - Virtual size: 411KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 45KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f897e4877bdf914ae18c502a00081810

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

oleaut32

netapi32

iphlpapi

rpcrt4

winmm

shlwapi

xmllite

kernel32

advapi32

shell32

ole32

Exports

Exports

Sections

.text Size: 848KB - Virtual size: 847KB

.rdata Size: 412KB - Virtual size: 411KB

.data Size: 45KB - Virtual size: 53KB

.pdata Size: 51KB - Virtual size: 51KB

.gfids Size: 2KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 848KB - Virtual size: 847KB

.rdata
Size: 412KB - Virtual size: 411KB

.data
Size: 45KB - Virtual size: 53KB

.pdata
Size: 51KB - Virtual size: 51KB

.gfids
Size: 2KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 7KB - Virtual size: 6KB