7bd6f98d46332d6181ef50f959daf7a977753f239941f2f7e31246e1e0c174fe

Sharing

Copy URL Twitter E-mail

General

Target

7bd6f98d46332d6181ef50f959daf7a977753f239941f2f7e31246e1e0c174fe
Size

245KB
MD5

1da1061335c39708aa5895573074c41b
SHA1

88bf92b9834163d7e8a5656466c69589e670ac8e
SHA256

7bd6f98d46332d6181ef50f959daf7a977753f239941f2f7e31246e1e0c174fe
SHA512

2f1b5876a56a2d8f9dca719d9dbc0b93171bcfab0207175d631a36a8a99e2f3d48ff429146c995624ab929c39085177f69395df3c4b2928be57cda0c3ff420af
SSDEEP

6144:Vnps+j/KDVkepQR93e8dslDgUxBaFLA0/h:Vnps+jyBDpQD3d2lkUQUq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7bd6f98d46332d6181ef50f959daf7a977753f239941f2f7e31246e1e0c174fe

Files

7bd6f98d46332d6181ef50f959daf7a977753f239941f2f7e31246e1e0c174fe
.dll windows:6 windows x64 arch:x64

b1a6bec95e078c6f6efb70f53d27c2e5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Sources\foobar2000\foobar2000\x64\Release\foo_playcount.pdb

Imports

kernel32

WaitForSingleObject
CreateEventW
InitializeCriticalSection
GetProcAddress
GlobalUnlock
WaitForMultipleObjects
GlobalLock
GetModuleHandleW
Sleep
IsDebuggerPresent
DecodePointer
ResetEvent
SetEvent
CloseHandle
GetProcessHeap
HeapAlloc
lstrlenW
GlobalFree
GlobalAlloc
GetCurrentProcess
HeapFree
SetThreadPriority
ResumeThread
GetThreadPriority
GetCurrentThread
GetTickCount64
SystemTimeToFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
RaiseException
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
InitializeCriticalSectionEx
GetLastError
DeleteCriticalSection
GlobalSize
SetLastError
FileTimeToLocalFileTime
OutputDebugStringW
GetSystemTimeAsFileTime
EncodePointer
DisableThreadLibraryCalls
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
LoadLibraryExA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead

user32

FillRect
CloseClipboard
SetClipboardData
GetWindowTextW
GetParent
IsWindowEnabled
OpenClipboard
DrawTextW
DrawEdge
EndPaint
GetSysColor
GetClientRect
CreateDialogParamW
RegisterClassW
LoadCursorW
ShowWindow
EnableWindow
GetDlgItem
DefWindowProcW
GetWindowLongPtrW
SetWindowLongPtrW
DestroyWindow
InvalidateRect
UnregisterClassW
SendMessageW
GetClipboardData
IsClipboardFormatAvailable
GetActiveWindow
MessageBeep
RegisterClipboardFormatW
BeginPaint

gdi32

CreateFontIndirectW
GetObjectW
SetTextColor
SelectObject
GetTextExtentPoint32W
SetBkMode
DeleteObject

shared

??1uCallStackTracker@@QEAA@XZ
??0uCallStackTracker@@QEAA@PEBD@Z
GetInfiniteWaitEvent
uCharLower
uGetOpenFileName
ModalDialog_CanCreateNew
ModalDialog_PokeExisting
uPrintCrashInfo_OnEvent
uBugCheck
uFormatSystemErrorMessage
uExceptFilterProc

msvcp140

?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_type_info_destroy_list
_CxxThrowException
__current_exception_context
__current_exception
memcmp
__std_terminate
__std_exception_destroy
__std_exception_copy
_purecall
__C_specific_handler
strstr
memcpy
memmove
strchr
memset

api-ms-win-crt-math-l1-1-0

llround
rint
floor
lround

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll
_configure_narrow_argv
_beginthreadex
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_invalid_parameter_noinfo_noreturn
terminate
_initterm
_initterm_e
_initialize_onexit_table
_initialize_narrow_environment

api-ms-win-crt-heap-l1-1-0

malloc
_callnewh
_expand
realloc
free

api-ms-win-crt-string-l1-1-0

strcmp
strncmp
_strdup
strlen

api-ms-win-crt-utility-l1-1-0

rand
srand

api-ms-win-crt-convert-l1-1-0

atoi

Exports

Exports

foobar2000_get_interface

Sections

.text
Size: 174KB - Virtual size: 174KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.movehcs
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b1a6bec95e078c6f6efb70f53d27c2e5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shared

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

Exports

Exports

Sections

.text Size: 174KB - Virtual size: 174KB

.rdata Size: 48KB - Virtual size: 47KB

.data Size: 5KB - Virtual size: 5KB

.pdata Size: 11KB - Virtual size: 10KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 2KB - Virtual size: 1KB

.movehcs Size: 512B - Virtual size: 4KB

.text
Size: 174KB - Virtual size: 174KB

.rdata
Size: 48KB - Virtual size: 47KB

.data
Size: 5KB - Virtual size: 5KB

.pdata
Size: 11KB - Virtual size: 10KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 1KB

.movehcs
Size: 512B - Virtual size: 4KB