Need For Speed The Run[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Need For Speed The Run.exe
Size

11.3MB
MD5

935ec0e83251459ac8223b9ace127e0c
SHA1

8f656d53e364998d2c23cb922dea16180b1b47a4
SHA256

93f287a6655c80a5cfe445fc5a0816f466b42316ed9433b848a493bf6e90ff87
SHA512

a06ef6126b77012ffa53b4d5e05809efcaf292cd6b2137c4799477a04238a2bb5aacf495509ecdefce30d0c865887e51311d39d6044d1823e97ee6b22e0e0aea
SSDEEP

196608:mjZQlznLGKaQ/MKdbO3OrxG+CUnwmrrEmKreSmg2QSFzQ46oLCAgN4eNx1S8jS+:mlQtLFbOWVapNdSFzQ46cgNZRS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Need For Speed The Run.exe

Files

Need For Speed The Run.exe
.exe windows:5 windows x86 arch:x86

de121d28eecccb3bbd6d8668bdef060c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
IsDebuggerPresent
GetSystemTime
SetCurrentDirectoryW
OutputDebugStringW
GetTempFileNameW
GlobalLock
GetModuleHandleA
GetProcAddress
GetCurrentThreadId
GetModuleHandleW
CreateProcessW
lstrcmpiW
InterlockedDecrement
GetFullPathNameA
ReleaseSemaphore
CreateSemaphoreA
GetLocaleInfoW
GetCurrentProcess
Module32Next
GlobalUnlock
GlobalMemoryStatusEx
CreateDirectoryW
OpenProcess
TerminateProcess
SetLastError
ReleaseMutex
SetPriorityClass
CreateToolhelp32Snapshot
Process32First
SetThreadIdealProcessor
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoA
IsProcessorFeaturePresent
InterlockedCompareExchange
GlobalFree
GlobalAlloc
GetPriorityClass
SetEnvironmentVariableA
GetDateFormatA
GetTimeFormatA
GetTimeZoneInformation
TryEnterCriticalSection
GetThreadPriority
SetWaitableTimer
GetCurrentProcessId
Module32First
Process32Next
CreateWaitableTimerA
GetLogicalDrives
lstrcatA
GetProcessHeap
HeapAlloc
HeapFree
CreateProcessA
CreateMutexA
SetErrorMode
Sleep
OpenMutexA
lstrcmpiA
lstrcpyA
InterlockedExchange
GetUserGeoID
GetGeoInfoA
CancelIo
GetLogicalDriveStringsA
GetDriveTypeA
GetLogicalDriveStringsW
GetModuleFileNameW
GetFullPathNameW
GetWindowsDirectoryW
GetDriveTypeW
GetVolumePathNameW
GetVolumeInformationW
GetDiskFreeSpaceExW
GetTempPathW
GetLongPathNameW
CopyFileA
MoveFileExW
GetFileAttributesW
GetLastError
SetEndOfFile
FindFirstChangeNotificationW
WaitForMultipleObjects
FindNextChangeNotification
FindCloseChangeNotification
FindFirstFileA
FindNextFileA
GetVersionExA
InterlockedExchangeAdd
MultiByteToWideChar
LoadLibraryW
VirtualProtect
GetUserDefaultLangID
DebugBreak
SetFileTime
GetFileAttributesA
SetFileAttributesA
MoveFileW
RemoveDirectoryW
DeleteFileW
CopyFileW
SetFileAttributesW
CreateFileW
WideCharToMultiByte
FindNextFileW
FlushFileBuffers
GetFileSizeEx
SetFilePointerEx
GetLocalTime
SystemTimeToFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
GetCurrentDirectoryW
FindClose
FindFirstFileW
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
DeleteFileA
CreateFileA
GetDiskFreeSpaceA
FileTimeToLocalFileTime
FileTimeToSystemTime
LoadLibraryExA
GetCurrentDirectoryA
GetCurrentProcessorNumber
GetModuleHandleExA
IsBadStringPtrA
CreateThread
WaitForSingleObject
Thread32First
Thread32Next
OpenThread
GetThreadContext
SetThreadContext
GetCommandLineA
GetEnvironmentVariableA
GetExitCodeProcess
ExitProcess
ReadFile
GetSystemInfo
GetComputerNameA
GetWindowsDirectoryA
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
FormatMessageA
LocalFree
ResetEvent
SetEvent
CreateEventA
SetThreadAffinityMask
SetThreadPriority
WaitForMultipleObjectsEx
WaitForSingleObjectEx
SleepEx
SwitchToThread
QueueUserAPC
ResumeThread
SuspendThread
RaiseException
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeSRWLock
QueryPerformanceCounter
QueryPerformanceFrequency
GetStdHandle
WriteFile
GetExitCodeThread
GetSystemTimeAsFileTime
GetTickCount
VirtualQuery
DuplicateHandle
VirtualAlloc
InitializeCriticalSectionAndSpinCount
GlobalMemoryStatus
VirtualFree
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetCurrentThread
LoadLibraryA
FreeLibrary
OutputDebugStringA
SetFilePointer
CloseHandle
InitializeCriticalSection
GetModuleFileNameW
GetModuleHandleW
TerminateProcess
GetCurrentProcess
DeleteCriticalSection
LoadLibraryW
CreateEventW
CompareStringW
SetLastError
GetModuleHandleA
VirtualProtect
GetTickCount
EnterCriticalSection
LeaveCriticalSection
VirtualFree
VirtualAlloc
WriteProcessMemory
CreateToolhelp32Snapshot
GetCurrentProcessId
GetCurrentThreadId
Thread32First
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
GetSystemInfo
FreeLibrary
LoadResource
MultiByteToWideChar
WideCharToMultiByte
FindResourceExW
FindResourceExA
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
GetSystemTime
GetLocalTime
SystemTimeToFileTime
CompareFileTime
GetCommandLineA
GetLastError
HeapFree
HeapAlloc
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetModuleFileNameA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapReAlloc
HeapSize
LoadLibraryA
GetLocaleInfoA
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InitializeCriticalSectionAndSpinCount
VirtualQuery
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetWindowTextA
IsIconic
PostMessageA
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
GetWindowLongA
SetWindowLongA
DestroyWindow
MoveWindow
SetFocus
GetDesktopWindow
wsprintfW
ShowWindow
GetWindowThreadProcessId
RegisterRawInputDevices
DefWindowProcA
EnumDisplaySettingsW
CallWindowProcA
MessageBoxA
GetForegroundWindow
UpdateWindow
CreateWindowExA
SetCursorPos
GetWindowInfo
ShowCursor
ClipCursor
SetWindowPos
GetDlgItem
SetWindowTextA
GetParent
FindWindowExW
MessageBoxW
PeekMessageA
PostQuitMessage
RegisterClassExA
LoadIconA
GetSysColorBrush
GetFocus
LoadStringA
EnumDisplaySettingsA
CloseWindow
MapWindowPoints
DispatchMessageA
TranslateMessage
GetClientRect
GetMonitorInfoA
MonitorFromWindow
GetKeyState
EmptyClipboard
SetClipboardData
GetWindowRect
GetWindow
SystemParametersInfoA
SetClipboardViewer
EndDialog
ChangeClipboardChain
SendMessageA
SetParent
PostThreadMessageA
IsWindowVisible
CloseClipboard
GetMessageA
SetTimer
AttachThreadInput
LoadCursorA
SetCursor
SetForegroundWindow
RegisterDeviceNotificationA
wsprintfA
KillTimer
UnregisterDeviceNotification
FindWindowA
CharUpperA
CharNextA
GetRawInputData
MessageBoxW
CharUpperBuffW
wsprintfW

gdi32

SetDCBrushColor
GetStockObject
DeleteDC
ExtEscape
CreateDCA

winmm

timeEndPeriod
timeGetDevCaps
timeGetTime
waveOutPrepareHeader
waveInPrepareHeader
waveOutUnprepareHeader
waveInMessage
waveOutMessage
waveInStop
waveInGetPosition
waveInAddBuffer
waveInStart
waveOutSetVolume
waveOutWrite
waveOutGetNumDevs
waveOutGetDevCapsA
waveOutReset
waveOutOpen
waveOutClose
waveInGetNumDevs
waveInGetDevCapsA
waveInReset
waveInOpen
waveInClose
waveInUnprepareHeader
timeBeginPeriod

urlmon

URLOpenBlockingStreamA
URLDownloadToCacheFileA

advapi32

GetCurrentHwProfileA
RegQueryValueExW
GetUserNameA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyExW
RegSetValueExA
RegGetValueA
RegCloseKey

shell32

SHBrowseForFolderW
SHCreateDirectoryExW
SHGetMalloc
ShellExecuteExW
SHFileOperationW
SHGetFolderPathW
ShellExecuteA
SHGetPathFromIDListW

oleaut32

SysFreeString
SysAllocString

msvcp90

?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0ABV12@@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEX_NI@Z
??0?$_String_val@DV?$allocator@D@std@@@std@@IAE@V?$allocator@D@1@@Z
??0?$allocator@D@std@@QAE@XZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHPB_W@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??Bios_base@std@@QBEPAXXZ
?width@ios_base@std@@QAEHH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?eof@?$char_traits@D@std@@SAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBEHXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?good@ios_base@std@@QBE_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?length@?$char_traits@D@std@@SAIPBD@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@JH@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??_D?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z

shlwapi

SHGetValueA
StrNCatA
StrStrIA
StrStrA
PathQuoteSpacesA
StrChrA

msvcr90

_wfopen
_aligned_free
_waccess_s
fwprintf
iswalpha
strncat_s
_strlwr
_wtof
wcsncpy
strtoul
fread
fgetpos
fsetpos
feof
fgets
fputs
_control87
strncat
getenv
_atoi64
atol
toupper
strcpy
strlen
__iob_func
fprintf
fseek
ldexp
isdigit
floor
_CIexp
_CIatan
_CIfmod
vsprintf
_errno
_HUGE
abort
_CItan
_CIasin
strcpy_s
_vsnwprintf
ceil
_fullpath
tolower
strncpy_s
sprintf_s
_set_output_format
_set_purecall_handler
isxdigit
rand
srand
_CIlog
qsort
_beginthreadex
_endthreadex
atoi
_mktime64
_gmtime64
_difftime64
_except_handler3
_wcslwr
_wcsupr
_wcsnicmp
_wcsicmp
vswprintf_s
sscanf
_CIpow
_CIlog10
strrchr
strstr
isspace
vsprintf_s
atof
bsearch
_vsnprintf_s
_CIatan2
strncmp
strtok
strncpy
sprintf
asctime
_time64
_localtime64
fwrite
fflush
_aligned_malloc
fclose
setvbuf
_vsnprintf
strtod
strtol
malloc
strchr
free
realloc
_CIsqrt
_CIsin
modf
_CIcos
_CIacos
strcat_s
printf
_snprintf
memset
memcpy
memmove
__argv
__argc
exit
_purecall
_wtoi
wcsncmp
wcsncat_s
_fseeki64
_ftelli64
__libm_sse2_acos
__libm_sse2_atan2
_utime64
_wutime64
?_wopen@@YAHPB_WHH@Z
__RTtypeid
??0exception@std@@QAE@ABQBDH@Z
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_controlfp_s
_invoke_watson
?terminate@@YAXXZ
_except_handler4_common
__set_app_type
__libm_sse2_sin
__libm_sse2_cos
__libm_sse2_pow
_gmtime64_s
_gmtime32_s
_localtime32_s
strtok_s
_controlfp
_wsplitpath_s
_i64toa_s
_invalid_parameter_noinfo
sscanf_s
_itoa_s
_ftime64
strspn
wcscoll
_wcsicoll
_wstat64
_wfopen_s
rewind
wcscat_s
wcsncpy_s
wcscpy_s
ftell
clearerr
fscanf
_popen
_pclose
setlocale
strftime
clock
rename
remove
system
strpbrk
memchr
islower
ispunct
isupper
frexp
_CItanh
_CIcosh
_CIsinh
isalnum
localeconv
iscntrl
strcoll
longjmp
_setjmp3
strcspn
getc
strerror
_ecvt
_strupr
_strnicmp
_stricmp
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
_isnan
_finite
_fcvt
_strtoui64
fgetc
ungetc
ferror
_get_tzname
_tzset
__timezone
__daylight
__CxxFrameHandler3
memmove_s
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
_strdup
??0exception@std@@QAE@XZ
_mbscmp
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
swscanf
wcsstr
_localtime64_s
isalpha
isprint
_wchdir
_wgetcwd
_stat64i32
fopen
_wstat64i32

bcrypt

BCryptGenRandom

dxgi

CreateDXGIFactory1

dwmapi

ord102

dinput8

DirectInput8Create

setupapi

SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInstanceIdA
SetupDiGetClassDevsA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

ws2_32

ntohs
ntohl
gethostbyname
WSASocketA
WSAIoctl
inet_addr
htonl
htons
gethostname
WSACleanup
WSAGetLastError
ioctlsocket
setsockopt
socket
listen
bind
getpeername
send
sendto
recv
WSAStartup
select
recvfrom
connect
accept
WSAAsyncSelect
inet_ntoa
__WSAFDIsSet
getsockopt
getsockname
WSAGetOverlappedResult
WSACreateEvent
shutdown
WSACloseEvent
WSASetEvent
WSARecv
WSARecvFrom
WSAResetEvent
WSAWaitForMultipleEvents
closesocket

dbghelp

SymGetModuleInfo64
MiniDumpWriteDump
SymGetModuleInfo
SymFromAddr
SymSetOptions
SymGetLineFromAddr64
StackWalk64
SymGetModuleBase64
SymLoadModuleEx
SymFunctionTableAccess64
SymInitialize

psapi

EnumProcesses
GetModuleBaseNameW
GetModuleBaseNameA
GetModuleFileNameExA
GetModuleInformation
EnumProcessModules

iphlpapi

GetAdaptersAddresses

dsound

ord1
ord9

d3d11

D3D11CreateDevice

d3dx11_43

D3DX11SaveTextureToMemory

xinput9_1_0

XInputGetState
XInputGetCapabilities
XInputSetState

d3dcompiler_43

D3DReflect

ole32

CoCreateInstance
CoInitialize
CoSetProxyBlanket
CoUninitialize
CoInitializeEx

comdlg32

GetSaveFileNameW
GetOpenFileNameW

netapi32

Netbios

Exports

Exports

gf��,&��Q/��ca�m��1� K��ϳ�I�<�i��Ln-a|_MTˤ<>��L�ښSOL� wgnH�Qxu��!�c��Z��r�/s�N�n��x�q�7=`��5�o�WY%��^.0-7j�-yVR��+��%�2%=L��͌E�2�૿�^J�� S�()T��#��I��)��t}F�FU₠EB^�r-��B��(ئ[R}-]>t63/�!��*��rp+�O��n_��`wd9�Ԃ��@V�(��U�_��@�O�t��9��a9�N��|�.06-7��%i�a;��w��l��Ȧ�+�ƭ��g��䴪K[��A"�Io��O2�;c�w^�^]��Z��&8��S��/X2_Wy��KC��6iGjy�.��ў�� )��հ� Qv��3d@��70S�&A�!�S�ػ߽J rL�� Z��8aIU��(4�d��Y �݆�X�Ļ�Z��~~hI,)��j�M��]��vW��cdY�2w�d;6 �ԑ��b�*�p0��9^|�\+rK�~�=�@+��o�y��Q��C�>�U��գ�-�*��ǭ�}#-�x ��ƞ� ��W9�վ S�E�+�Aw�C�$G��&nA��5䖨bs-�M=f<�V2p{c�T9�K> W3��,�:�1�t�(��0��i��0-qy(��H��:ٍ W�[�l�$gnx�o�&��6!�Ǡ\�bO\sE�o(#=��E1��A3u&��N�Q�d�P�% �nd��_�2-]�Rʺs/��,�jA��Y\��Nm��)��j��X�^��N/�g4��Xʢ�[r ��P��Y&��ONԎ�چ�uu��񗔺`L�ŕ��O��2?n��:a��0SC��a)3ܯ�!l�Zm¹�/��S+wH՚`@�]*U��[��pQ��w]�H��I]�&�ߺ:T��l�hr�'wx��8JZ�Iy��cϓ1�Z�Ӗw�j;�oA�x��Tʁ�#��A��У �OQT�(��&9��XQ�=O�� q�`�W��K��԰Λ�#��*�Z�b�RS]p8ɀ�Ơ�o��&��g�<��b�]�*俢Gj�]��)�C�]&b�#��L==:2�@��M�Q^S��aJ3H�wHM�T�C��J�ŝH��^�S�$v�2�##�iJ�z� �M��q��97��K��_]�H�W��߷��ׅZ�X�*��h%�Ԇ��ԃ��hT�m��#�(�C�h�ܚ��:Ԉ��bǏcsp��w� D�?�O�LŁ"M]�:��]��j�u�`N��o��|q�cS�{+�h�E�l㖞4�o&YS�[��}� ��J̫�� }��]xܿm�⁬%�>[�� Ā;A��?K��ȊvպT��?oAi|�A�S E�B9�~Z�e�T+�ځ3m�ω ��Ҽ�r;)��o��s�7w��W��<n� �ሻ��i�?�*"u��~�u$s��D��W��Ő>23� #�#*;t*�.!ѷ4߳��ˊ��C�"a�ȧ��h�o��(k�?��9�3�3C��'��s5� TRXj�/�K��]�O��Z��dWof�g�긘##Ѐu��/ʖw2�W�^�S�cڀ�) ��:?�:��K�ٿ�n��:a�&�*ݤFA<�LG�z�r5��%� �[�N�%�v�׹X��e9f��+ۻ��6�a�L� 2.�n�i� ,5��ZkZ \A�A��1+��Q{��5��2�)%��8i�e�=�h�{�0��,�"vO�;��u��`b��S(W�@YW�ݱc|�Hy��Y�F��2Ѿ.��~��5+_,��LEs��n5!��64��$�%��%~�%�-b�eVl�b��ݽ=Ud]�Ixʀ^�"��F�}�v�;3|Z�?��2��P��tA�AT��]��W|b��x�=Ω!Y$�f]DR�Nj"A:�6É5Ƙ[�1�� -�L�;�M0 �i�-�~>s��L�eV�^�YhV�;�� =�%��hBu7�� S�٘�Nˤ��l񔧣}$9��nw]x�q��R�C��zx`'�D8�w��,9NE��'P��S� L�ȸ?��7��V��v��Vcp�JW��C��,5��T��z\vd�_ T�0xM�{h��/��4л�)E��H��zU�h_2�vW�ڔ��C�ni��<�d�,�U�~�S��6sZY��w�1��Y&:��4�nb��`�EܩcCbepL�8& ?}��Qt+�e�z��ߠ1��z��|P��M|U��;H+��ؙK��qRj5��~H��W��u�=��mЋi�bJ�� h[ȇ˵_��e�A q�u$$��*�H��B/��\Y��o�@Al��y��T��q�6�Ҕ0��%nx��??�al�Y�U�xq|�d&8��ۉp#]}\ID6a�ي3�[��f�s��Vէ;��m��a�q��V�4�x��e0�a�gb~T�0q�f��Ч�;�]n��ē��ѥ�� #��U�#)5�s�@�N<@2Ec8�R��w��ՠ��N7��4�`2km��1 �6(��B qYɷ�婐�-V��z\�?K��:��O�tG@cѹ�h>��Sg��G��|c�3N��)R1�M�L�⮽X��K8�& ��+a� N0K��Ӵ� _��ȇ��v� ��~ݚ��]ߡVdl;<v@`�S��.�f�� G�i�� Y�)��GVJ��'�#>�� [�,��O�ǒ?΍�o?�_�=t}�i��.7�E.e��[��kv��s��8�q5Y{繿D�ͦJ�N*�j��J�Х$w��[��2�&�_�r_�b�Y�.�{�R�'(�

Sections

.text
Size: - Virtual size: 30.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

ctr
Size: - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 3.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

typeinfo
Size: - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

fieldinf
Size: - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 312B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ALI2130
Size: - Virtual size: 437KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ALI2131
Size: 11.1MB - Virtual size: 11.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 222KB - Virtual size: 222KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

de121d28eecccb3bbd6d8668bdef060c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

winmm

urlmon

advapi32

shell32

oleaut32

msvcp90

shlwapi

msvcr90

bcrypt

dxgi

dwmapi

dinput8

setupapi

version

ws2_32

dbghelp

psapi

iphlpapi

dsound

d3d11

d3dx11_43

xinput9_1_0

d3dcompiler_43

ole32

comdlg32

netapi32

Exports

Exports

Sections

.text Size: - Virtual size: 30.0MB

ctr Size: - Virtual size: 1.8MB

.rdata Size: - Virtual size: 3.3MB

.data Size: - Virtual size: 3.5MB

.idata Size: - Virtual size: 28KB

typeinfo Size: - Virtual size: 416KB

fieldinf Size: - Virtual size: 240KB

.tls Size: 312B - Virtual size: 4KB

ALI2130 Size: - Virtual size: 437KB

ALI2131 Size: 11.1MB - Virtual size: 11.1MB

.rsrc Size: 222KB - Virtual size: 222KB

.text
Size: - Virtual size: 30.0MB

ctr
Size: - Virtual size: 1.8MB

.rdata
Size: - Virtual size: 3.3MB

.data
Size: - Virtual size: 3.5MB

.idata
Size: - Virtual size: 28KB

typeinfo
Size: - Virtual size: 416KB

fieldinf
Size: - Virtual size: 240KB

.tls
Size: 312B - Virtual size: 4KB

ALI2130
Size: - Virtual size: 437KB

ALI2131
Size: 11.1MB - Virtual size: 11.1MB

.rsrc
Size: 222KB - Virtual size: 222KB