tmp | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

tmp
Size

8.0MB
MD5

8463e83c1497227b4a4c037548a467ef
SHA1

3fe341a0ba3532acc0dc91977d9f70d530842798
SHA256

1543b076251325ff8d65ec5b7805b5dd216b6f98e23e8c4401282fc90ee4dcc8
SHA512

6f120eacb4a96a78a7290b3a404edc4a74db41c03c4befd9850751e470d66752985682a1f825778560886a9a5579cff771489921d49cf05b8a5bf92b2dac343e
SSDEEP

196608:mC/KxD/0UepKIXdsBQtLCs9sTzJIV++6gXzhJLMkh3IL2:mCovSW+V+g9JbBI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmp

Files

tmp
.exe windows:6 windows x86 arch:x86

1828a3699d0c16a0c67bddf3c5c111e8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\WarZ2\src\RSUpdate\Release\RSUpdate.pdb

Imports

d3dx9_43

D3DXCreateTextureFromFileInMemoryEx
D3DXCreateCubeTextureFromFileInMemoryEx
D3DXCreateVolumeTextureFromFileInMemoryEx
D3DXSaveSurfaceToFileA
D3DXGetImageInfoFromFileInMemory
D3DXCreateFontA
D3DXCreateTextureFromFileInMemory

d3d9

Direct3DCreate9

kernel32

TerminateProcess
UpdateProcThreadAttribute
CreateProcessW
SetEnvironmentVariableA
OutputDebugStringW
WriteConsoleW
LCMapStringW
CompareStringW
HeapReAlloc
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
FindFirstFileExW
FlushFileBuffers
SetStdHandle
ReadConsoleW
SetFilePointerEx
GetStringTypeW
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetConsoleMode
GetConsoleCP
GetCPInfo
IsValidCodePage
FreeLibrary
DeleteCriticalSection
CreateFileW
GetFileSize
WriteFile
ReadFile
GetModuleHandleW
TlsFree
GetFileTime
FormatMessageA
TlsSetValue
TlsGetValue
TlsAlloc
UnhandledExceptionFilter
GetComputerNameA
GetOEMCP
SetLastError
GetStartupInfoW
GetStdHandle
GetFileAttributesExW
HeapSize
AreFileApisANSI
ExitProcess
PeekNamedPipe
GlobalMemoryStatusEx
LoadLibraryA
GetProcAddress
GetVersionExA
MultiByteToWideChar
GetACP
GetTickCount
GetLocalTime
GetSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
CreateThread
GetCurrentThreadId
CreateFileA
GetFileAttributesA
SetFileAttributesA
CreateDirectoryA
FindClose
SetFileAttributesW
CreateDirectoryW
GetModuleFileNameA
CopyFileA
WaitForSingleObject
TerminateThread
CloseHandle
EnterCriticalSection
LeaveCriticalSection
GetFileType
GetFileInformationByHandle
FileTimeToLocalFileTime
GetProcessHeap
RaiseException
GetModuleHandleExW
GetCommandLineA
HeapFree
HeapAlloc
IsProcessorFeaturePresent
LoadLibraryExW
ExitThread
GetSystemTimeAsFileTime
DecodePointer
EncodePointer
VirtualAlloc
Module32Next
Module32First
CreateToolhelp32Snapshot
ResumeThread
GetCurrentProcessId
SetUnhandledExceptionFilter
CreateFileMappingA
UnmapViewOfFile
GetFileAttributesW
lstrlenA
OpenFileMappingA
InitializeProcThreadAttributeList
VirtualProtect
WTSGetActiveConsoleSessionId
GlobalFree
SetFilePointer
DeleteFileW
MoveFileW
GetModuleFileNameW
GetTempPathA
GetTempPathW
GetCurrentDirectoryW
GetFullPathNameW
LocalFree
GetLastError
InitializeCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceA
MoveFileA
DeleteFileA
SetConsoleTitleA
AllocConsole
Sleep
GlobalAlloc
GlobalUnlock
GlobalLock
GetExitCodeProcess
GetCurrentProcess
MulDiv
GetCurrentDirectoryA
GetFullPathNameA
CreateEventA
SetEvent
OutputDebugStringA
OpenEventA
GetCurrentThread
TryEnterCriticalSection
DuplicateHandle
MapViewOfFile
IsDebuggerPresent
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeCriticalSectionAndSpinCount
WideCharToMultiByte
GetModuleHandleA
SetEndOfFile
GetSystemInfo

user32

ShowCursor
InvalidateRect
EndPaint
PostQuitMessage
PeekMessageW
GetMessageW
ClientToScreen
GetClientRect
SetWindowPos
BeginPaint
UpdateWindow
GetActiveWindow
ChangeClipboardChain
SetClipboardViewer
CreateWindowExA
SendMessageA
SetFocus
MessageBoxA
LoadIconA
LoadCursorA
LoadStringW
SetRect
AdjustWindowRect
GetWindowLongA
SwitchToThisWindow
GetAsyncKeyState
CloseClipboard
GetClipboardData
OpenClipboard
GetKeyState
GetFocus
GetCaretBlinkTime
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
ShowWindow
SetWindowTextA
SetWindowLongA
DefWindowProcA
SetCapture
GetWindowRect
GetCursorPos
ReleaseCapture
ClipCursor
RegisterClassA

gdi32

CreateICA
DeleteDC
GetDeviceCaps
GetStockObject
CreateCompatibleDC
CreateFontA
CreatePen
DeleteObject
GetTextExtentPoint32A
LineTo
SelectObject
SetBkColor
SetMapMode
SetTextColor
SetTextAlign
CreateDIBSection
MoveToEx
ExtTextOutA

advapi32

RegCloseKey
GetUserNameA
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
CryptExportKey
CryptDestroyKey
CloseServiceHandle
OpenServiceA
OpenSCManagerA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
CryptAcquireContextW
CryptGetProvParam
CryptEnumProvidersA
QueryServiceStatusEx
CryptGetUserKey

shell32

SHGetFolderPathA
ShellExecuteExA
ShellExecuteA

ole32

CoUninitialize
CoSetProxyBlanket
CoInitializeEx
CoInitialize
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
VariantClear
SysStringLen

iphlpapi

GetAdaptersInfo
GetIpNetTable
SendARP
GetNetworkParams

ntdll

RtlImageNtHeader
RtlUnwind

dbghelp

MiniDumpWriteDump
MakeSureDirectoryPathExists

wtsapi32

WTSSendMessageA

ws2_32

shutdown
closesocket
sendto
recvfrom
recv
send
inet_ntoa
getsockopt
setsockopt
ioctlsocket
WSAGetLastError
socket
WSAStartup
ntohs
getsockname
gethostbyname
inet_addr
htons
connect
select
__WSAFDIsSet
bind

dinput8

DirectInput8Create

crypt32

CertEnumCertificatesInStore
CertCreateCertificateContext
CertGetCertificateContextProperty
CryptDecodeObject
CertSetCertificateContextProperty
CertDuplicateCertificateContext
CertNameToStrW
CertFreeCertificateContext
CryptEncryptMessage
CertCloseStore
CertGetSubjectCertificateFromStore
CryptMsgControl
CryptMsgGetParam
CryptMsgClose
CryptMsgUpdate
CryptMsgOpenToDecode
CryptDecryptMessage
CryptEncodeObject
CertOpenStore

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 767KB - Virtual size: 766KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.1MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1828a3699d0c16a0c67bddf3c5c111e8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

d3dx9_43

d3d9

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

iphlpapi

ntdll

dbghelp

wtsapi32

ws2_32

dinput8

crypt32

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 767KB - Virtual size: 766KB

.data Size: 1.1MB - Virtual size: 1.9MB

.tls Size: 512B - Virtual size: 9B

_RDATA Size: 3KB - Virtual size: 3KB

.rsrc Size: 4.1MB - Virtual size: 4.1MB

.reloc Size: 83KB - Virtual size: 83KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 767KB - Virtual size: 766KB

.data
Size: 1.1MB - Virtual size: 1.9MB

.tls
Size: 512B - Virtual size: 9B

_RDATA
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 4.1MB - Virtual size: 4.1MB

.reloc
Size: 83KB - Virtual size: 83KB