teardown[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

teardown.exe
Size

7.3MB
MD5

6d919299109890f72fb40c213b5adcf4
SHA1

f8f7d250d566bba96e6da41bdba602c128afa3e2
SHA256

8ef35d99440069b18df978b4d4b0e072dd2b8ef7f9d5a530199e4ac9157997ca
SHA512

ebe8425a80f4dd89ac3828d89cf3211a775f0984a642623d1e6682f1ece6283cd0f5364007aaffb45973b07cecfcbf16f0217baf7f6c2b33915fe80e53e9bad6
SSDEEP

49152:XeRnyRYk3g6FAFhfWRa9OOXRTFqPchRdpAjAwVJeb6wReZVn2qGoEVylhs537/wb:SWu5TQTMMM/KuLqD2b1fG/tfhR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
teardown.exe

Files

teardown.exe
.exe windows:6 windows x64 arch:x64

a292d27a910a19dca957226713ee3283

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\BuildAgent\work\teardown\teardown.pdb

Imports

wsock32

WSAStartup
WSACleanup
accept
bind
closesocket
getsockname
htonl
gethostbyname
ntohs
connect
inet_ntoa
recv
select
send
ntohl
setsockopt
shutdown
listen
htons
socket

ws2_32

getnameinfo

opengl32

wglGetCurrentDC
wglGetProcAddress
glGetError
glBindTexture
glBlendFunc
glClear
glClearColor
glColorMask
glCullFace
glDeleteTextures
glDepthFunc
glDepthMask
glDisable
glGetIntegerv
glEnable
glFinish
glFlush
glGenTextures
glLineWidth
glPixelStorei
glPolygonMode
glPolygonOffset
glReadBuffer
glReadPixels
glScissor
glStencilFunc
glStencilMask
glStencilOp
glTexImage2D
glTexParameterfv
glTexParameteri
glTexSubImage2D
glViewport
wglCreateContext
wglDeleteContext
wglMakeCurrent
glGetString

dxgi

CreateDXGIFactory1

dbghelp

SymFromAddr
SymInitialize
MiniDumpWriteDump
SymSetOptions
SymGetModuleBase64
SymFunctionTableAccess64
StackWalk64
SymCleanup

pros.sdk.x64

prosdk_account_get_qr_code
prosdk_account_connect
prosdk_user_get_kernel_session_id_visual_alias
prosdk_user_get_connection_state
prosdk_user_connect_psn_token
prosdk_user_connect_xbox
prosdk_user_connect_steam
prosdk_account_get_status
prosdk_user_connect_developer
prosdk_authorization_user_create
prosdk_telemetry_user_event
prosdk_telemetry_deprecated_event
prosdk_mods_connect
prosdk_mods_disconnect
prosdk_http_request_get_framed
prosdk_mods_subscribe_to_mod
prosdk_mods_unsubscribe_from_mod
prosdk_mods_add_mod
prosdk_mods_add_mod_version
prosdk_mods_upload_mod_image
prosdk_mods_rate_mod
prosdk_init
prosdk_update
prosdk_container_transfer_upload_rawdata
hydra5_diagnostics_get_crash_reporter_user_token
prosdk_disconnect_everything
hydra5_diagnostics_release_crash_reporter_user_token
prosdk_term
prosdk_is_executing_requests
prosdk_get_error_message
prosdk_user_connect_epic_online_services
prosdk_http_request_get
prosdk_mods_get_connection_state

kernel32

GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
CreatePipe
SetConsoleCtrlHandler
SetEndOfFile
HeapQueryInformation
HeapSize
SetFileAttributesW
CreateSymbolicLinkW
GetFileInformationByHandleEx
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
GetTickCount64
GetSystemTimeAsFileTime
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
InitOnceExecuteOnce
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetFileInformationByHandle
LCMapStringEx
DecodePointer
EncodePointer
GetLocaleInfoEx
LocalFree
GetNativeSystemInfo
GetExitCodeThread
SwitchToThread
MoveFileExW
DeleteFileW
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapReAlloc
SetStdHandle
GetTimeZoneInformation
GetFileAttributesExW
GetExitCodeProcess
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTempPathW
HeapAlloc
HeapFree
WriteFile
GetStdHandle
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateProcessW
GetModuleHandleExW
ExitProcess
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
GetFileInformationByHandle
GetDriveTypeW
DuplicateHandle
ReadFile
GetEnvironmentStringsW
WriteConsoleW
GetDiskFreeSpaceExA
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
LocaleNameToLCID
GetUserDefaultLocaleName
OutputDebugStringA
GlobalMemoryStatusEx
GetCurrentProcess
K32GetProcessMemoryInfo
RtlCaptureContext
CreateFileW
CloseHandle
SetUnhandledExceptionFilter
SetErrorMode
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
VirtualQuery
GetModuleFileNameW
GetModuleHandleExA
GetModuleHandleA
GetProcAddress
SwitchToFiber
DeleteFiber
ConvertFiberToThread
CreateFiber
ConvertThreadToFiber
GetLastError
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventA
CreateSemaphoreA
GetFileAttributesA
QueryPerformanceCounter
Sleep
GetSystemInfo
CreateThread
SetThreadPriority
TerminateThread
SetThreadAffinityMask
QueryPerformanceFrequency
InitializeCriticalSectionAndSpinCount
DeleteFileA
FindClose
FindFirstFileA
FindNextFileA
RemoveDirectoryA
MoveFileA
GetCurrentDirectoryA
GetModuleFileNameA
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
CreateEventW
GetModuleHandleW
GetLocalTime
LoadLibraryA
FreeLibrary
LoadLibraryW
K32EnumProcessModules
FormatMessageA
WaitForMultipleObjectsEx
WaitForSingleObjectEx
TryAcquireSRWLockShared
TryAcquireSRWLockExclusive
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetStringTypeW
CompareStringEx
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
InitializeSListHead
TerminateProcess
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedPushEntrySList
GetCommandLineW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
LoadLibraryExW
InterlockedFlushSList
SetLastError
RtlUnwind
TlsAlloc
TlsGetValue
OutputDebugStringW
GetCPInfo
TlsFree
CreateDirectoryA
TlsSetValue

user32

OpenClipboard
EmptyClipboard
GetSystemMetrics
TranslateMessage
DispatchMessageA
PeekMessageA
DefWindowProcA
PostQuitMessage
RegisterClassW
UnregisterClassW
CreateWindowExW
DestroyWindow
ShowWindow
SetWindowPos
SetFocus
RegisterRawInputDevices
ReleaseCapture
SetForegroundWindow
GetDC
ReleaseDC
GetWindowRect
AdjustWindowRectEx
MessageBoxA
GetForegroundWindow
QueryDisplayConfig
GetDisplayConfigBufferSizes
ChangeDisplaySettingsExA
ShowCursor
SetCursorPos
ClientToScreen
SetWindowLongPtrA
SetClassLongPtrA
GetRawInputData
SetCapture
SetClipboardData
LoadCursorA
CloseClipboard
LoadIconA
EnumDisplayMonitors
GetMonitorInfoA
GetClipboardData
DisplayConfigGetDeviceInfo

gdi32

SwapBuffers
ChoosePixelFormat
SetPixelFormat

shell32

SHGetSpecialFolderPathA
ShellExecuteA

ole32

CoInitializeEx
CoSetProxyBlanket
CoCreateInstance
CoUninitialize

oleaut32

GetErrorInfo
VariantChangeType
CreateErrorInfo
SetErrorInfo
VariantClear
VariantInit
SysFreeString
SysAllocString

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext

steam_api64

SteamAPI_GetHSteamUser
SteamInternal_ContextInit
SteamInternal_FindOrCreateUserInterface
SteamAPI_RunCallbacks
SteamInternal_CreateInterface
SteamAPI_RegisterCallback
SteamAPI_UnregisterCallback
SteamAPI_RegisterCallResult
SteamAPI_UnregisterCallResult
SteamAPI_Init
SteamAPI_Shutdown

dsound

ord1

Exports

Exports

AmdPowerXpressRequestHighPerformance
D3D12SDKPath
D3D12SDKVersion
NvOptimusEnablement

Sections

.text
Size: 5.0MB - Virtual size: 5.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 321KB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a292d27a910a19dca957226713ee3283

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wsock32

ws2_32

opengl32

dxgi

dbghelp

pros.sdk.x64

kernel32

user32

gdi32

shell32

ole32

oleaut32

imm32

steam_api64

dsound

Exports

Exports

Sections

.text Size: 5.0MB - Virtual size: 5.0MB

.rdata Size: 1.7MB - Virtual size: 1.7MB

.data Size: 321KB - Virtual size: 1.6MB

.pdata Size: 208KB - Virtual size: 208KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 35KB - Virtual size: 35KB

.reloc Size: 40KB - Virtual size: 40KB

.text
Size: 5.0MB - Virtual size: 5.0MB

.rdata
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 321KB - Virtual size: 1.6MB

.pdata
Size: 208KB - Virtual size: 208KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 35KB - Virtual size: 35KB

.reloc
Size: 40KB - Virtual size: 40KB