6c2b35f69ef7a3a8ce1c3e8a48802452

Sharing

Copy URL Twitter E-mail

General

Target

6c2b35f69ef7a3a8ce1c3e8a48802452
Size

54KB
MD5

6c2b35f69ef7a3a8ce1c3e8a48802452
SHA1

c8ed816a74cf9788aeae855b9b1b214366aca2b3
SHA256

851ac7af4d7d59e13e5f8e20909d3bf62e6182277461ba136dbca6e9f4266338
SHA512

eed986d252b6a002726531c6a279b1f3bcd757393975784d03341cd2cdaf4436a93e0f851f8dc87a9d6ec57a210c0f47fcbb7275bbbc245a229ba404e051cb01
SSDEEP

768:Oqk1juVQem+Wz9cmfPQ0xjXGBq9c414r58bITg:NQG89cPK1g55Tg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6c2b35f69ef7a3a8ce1c3e8a48802452

Files

6c2b35f69ef7a3a8ce1c3e8a48802452
.exe windows:6 windows x86 arch:x86

d65729e10ab6e9dc1d31e7460a011f61

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\GitLab-Runner\builds\651dcee5\2\BC\public\linphone-sdk\build-desktop\WORK\desktop\Build\ms2\tools\RelWithDebInfo\mediastream.pdb

Imports

mediastreamer

video_stream_iterate
video_stream_start_from_io
video_stream_set_display_filter_name
video_stream_set_event_callback
video_stream_new
audio_stream_enable_zrtp
audio_stream_get_average_quality_rating
audio_stream_get_quality_rating
audio_stream_stop
video_stream_set_freeze_on_error
ms_snd_card_manager_get_list
audio_stream_enable_noise_gate
audio_stream_set_echo_canceller_params
audio_stream_enable_automatic_gain_control
audio_stream_enable_echo_limiter
ms_mire_webcam_desc_get
audio_stream_new
audio_stream_start_full
ms_snd_card_get_string_id
media_stream_get_quality_rating
ms_ticker_get_average_load
ms_factory_set_mtu
ms_factory_log_statistics
ms_factory_reset_statistics
video_stream_stop
ms_snd_card_manager_get_default_capture_card
video_stream_set_sent_video_size
video_stream_use_preview_video_window
ms_is_ipv6
media_stream_enable_srtp
media_stream_enable_adaptive_bitrate_control
ms_factory_enable_statistics
ms_factory_get_web_cam_manager
ms_factory_get_snd_card_manager
ms_factory_destroy
ms_factory_new_with_voip
ms_filter_call_method
ms_srtp_supported
ms_snd_card_set_preferred_sample_rate
ice_session_new
ms_web_cam_manager_get_cam
ms_web_cam_manager_get_default_cam
ms_web_cam_manager_add_cam
ms_bandwidth_controller_destroy
ice_dump_session
ice_session_start_connectivity_checks
ice_session_choose_default_remote_candidates
ms_snd_card_manager_get_card
ice_session_choose_default_candidates
ice_session_compute_candidates_foundations
ms_bandwidth_controller_add_stream
ms_bandwidth_controller_new
audio_stream_iterate
ms_web_cam_new
ice_session_set_base_for_srflx_candidates
ice_add_remote_candidate
ice_add_local_candidate
ice_session_add_check_list
ice_session_set_remote_credentials
ice_session_set_local_credentials
ice_check_list_destroy
ice_check_list_new
ice_session_destroy

ortp

payload_type_new
av_profile
payload_type_vp8
payload_type_jpeg
payload_type_x_snow
payload_type_h264
payload_type_theora
payload_type_mp4v
payload_type_amr
payload_type_ilbc
payload_type_speex_wb
payload_type_speex_nb
payload_type_lpc1015
b64_encode
rtp_stats_display
ortp_init
rtp_session_enable_network_simulation
rtp_session_get_jitter_stats
rtp_session_get_stats
rtp_session_get_recv_bandwidth
rtp_session_get_send_bandwidth
rtp_session_register_event_queue
payload_type_h263_1998
rtp_session_set_jitter_compensation
ortp_ev_queue_get
ortp_ev_queue_destroy
ortp_ev_queue_new
ortp_event_destroy
ortp_event_get_data
ortp_event_get_type
rtcp_sdes_parse
rtcp_is_SDES
rtcp_is_RR
rtcp_is_SR
rtcp_next_packet
rtp_profile_destroy
rtp_profile_clone_full
rtp_profile_set_payload
payload_type_set_avpf_params
payload_type_set_send_fmtp
payload_type_set_recv_fmtp
ortp_strdup
ortp_malloc0
ortp_free
rtp_session_set_pktinfo

user32

TranslateMessage
DispatchMessageA
PeekMessageA

bctoolbox

bctbx_logv
bctbx_set_log_file
bctbx_strcat_printf
bctbx_set_log_level

api-ms-win-core-synch-l1-2-0

Sleep

vcruntime140

memset
strchr
strrchr
_except_handler4_common
__std_type_info_destroy_list

api-ms-win-crt-convert-l1-1-0

atoi
atof
strtol

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode
__stdio_common_vsscanf
__stdio_common_vsprintf
__stdio_common_vfprintf
fopen
fclose
__acrt_iob_func

api-ms-win-crt-heap-l1-1-0

free
malloc
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

_c_exit
exit
__p___argv
signal
_seh_filter_dll
_initialize_onexit_table
__p___argc
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_controlfp_s
terminate
_seh_filter_exe
_initterm_e
_cexit
_register_onexit_function
_set_app_type
_exit
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_register_thread_local_exe_atexit_callback

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-string-l1-1-0

_strdup
_stricmp
strncpy
isdigit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

kernel32

GetStartupInfoW
UnhandledExceptionFilter
GetModuleHandleW

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d65729e10ab6e9dc1d31e7460a011f61

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mediastreamer

ortp

user32

bctoolbox

api-ms-win-core-synch-l1-2-0

vcruntime140

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-debug-l1-1-0

kernel32

Sections

.text Size: 26KB - Virtual size: 26KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 9KB - Virtual size: 9KB

.00cfg Size: 512B - Virtual size: 260B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 26KB - Virtual size: 26KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 9KB - Virtual size: 9KB

.00cfg
Size: 512B - Virtual size: 260B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB