f8bdb692b04c22748241fb01e34da34f29484dfa96f2732d69140bbcb0a3cda0

Sharing

Copy URL Twitter E-mail

General

Target

f8bdb692b04c22748241fb01e34da34f29484dfa96f2732d69140bbcb0a3cda0
Size

948KB
MD5

ca03867a5e36a5eafb21ff34c532ffb1
SHA1

beae6352c83d7b13c46c4084d9417f1b4fd2e2b4
SHA256

f8bdb692b04c22748241fb01e34da34f29484dfa96f2732d69140bbcb0a3cda0
SHA512

95cd008ba15c119f9eda44b53de575e10491b8fc69cf4c6559fb946c025d8002135b6aa5499a7cb4aa982ca8cfcac0c006f85ea785f72a276ca621eb883826e4
SSDEEP

24576:+0fZSo2wuwkOr/lKUl34mU518k7bGkWq2CW5kO5OaPkIuUFwJy00bJNYTeq0GVPL:tfZSo2wuwkOr/lKUl34mU518k7bGNFwL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f8bdb692b04c22748241fb01e34da34f29484dfa96f2732d69140bbcb0a3cda0

Files

f8bdb692b04c22748241fb01e34da34f29484dfa96f2732d69140bbcb0a3cda0
.dll windows:4 windows x86 arch:x86

d59bf79d6970c540a90ba056e99e1b99

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

LoadCursorA
SetCursor
GetDesktopWindow
SetCursorPos
MessageBoxA
ClientToScreen
SetForegroundWindow
ShowWindow
SetTimer
KillTimer
GetCursorPos
GetActiveWindow
SystemParametersInfoA
GetClientRect
ScreenToClient
CloseClipboard
SetClipboardData
RegisterClipboardFormatA
EmptyClipboard
OpenClipboard
GetClipboardData
WindowFromPoint
wsprintfA

kernel32

GetCurrentDirectoryA
SetCurrentDirectoryA
DeviceIoControl
CloseHandle
CreateFileA
GetShortPathNameA
GetModuleFileNameA
GetCurrentProcess
SizeofResource
LockResource
LoadResource
FindResourceA
GetVolumeInformationA
GetWindowsDirectoryA
GetComputerNameA
GetVersionExA
GetProcAddress
LoadLibraryA
GetLastError
OutputDebugStringA
GlobalUnlock
GlobalLock
GlobalAlloc
SetPriorityClass
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetOEMCP
GetACP
GetCPInfo
GetTickCount
GetTempPathA
CreateProcessA
GetExitCodeProcess
IsBadReadPtr
IsBadWritePtr
MulDiv
CreateMutexA
WaitForSingleObject
ReleaseMutex
FileTimeToDosDateTime
GetSystemTimeAsFileTime
FindClose
FindFirstFileA
GetTempFileNameA
GetFileAttributesA
CreateDirectoryA
FindNextFileA
CompareFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
FileTimeToLocalFileTime
GetPrivateProfileIntA
WritePrivateProfileStringA
GetVersion
SetFileAttributesA
QueryPerformanceCounter
QueryPerformanceFrequency
FreeLibrary
ExitProcess
TerminateProcess
HeapFree
HeapAlloc
GlobalSize
GetCommandLineA
InterlockedDecrement
InterlockedIncrement
HeapReAlloc
DeleteFileA
SetEndOfFile
RtlUnwind
HeapSize
GetModuleHandleA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
WideCharToMultiByte
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
FlushFileBuffers
WriteFile
lstrlenA
SetFilePointer
LocalFree
FormatMessageA
MultiByteToWideChar
LCMapStringA
LCMapStringW
RaiseException
ReadFile
GetStringTypeA
GetStringTypeW
SetStdHandle

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegEnumValueA
RegEnumKeyExA
RegCreateKeyA
RegSetValueExA
GetUserNameA

gdi32

DeleteObject

shell32

ShellExecuteA

Exports

Exports

radll_DrawNextFrameIntoBuffer
radll_EnableWindowsMouseCursor
radll_EnterMenuSession
radll_GetDLLVersionAsInt
radll_GetDLLVersionAsString
radll_GetLastErrorInformation
radll_GetNumberOfRectsToUpdate
radll_GetUnlockCode
radll_GetUpdateRect
radll_GetValueAsFloat
radll_GetValueAsInt
radll_GetValueAsString
radll_HandleWindowsMessage
radll_HasTheProductBeenPurchased
radll_Initialize
radll_IsASystemUpdateRequired
radll_IsTheMenuSessionComplete
radll_SetMousePosition
radll_SetPalette
radll_SetTrackingMetadata
radll_ShutDown
unittest_DecryptBase32to10
unittest_DecryptUnlockCode
unittest_DegenerateProductID
unittest_GenerateNonZeroBaseNineString
unittest_GenerateNumberFromNonZeroBaseNineString
unittest_GenerateProductID
unittest_GenerateSubIDforString
unittest_GetBrandedApplicationID
unittest_GetBrandedKeyRevision
unittest_GetLocalHardwareID
unittest_ObfuscateString
unittest_UnobfuscateString
unittest_ValidateRegCode
unittest_ValidateUnlockCode

Sections

.text
Size: 720KB - Virtual size: 717KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 84KB - Virtual size: 708KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 56KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d59bf79d6970c540a90ba056e99e1b99

Headers

File Characteristics

Imports

user32

kernel32

advapi32

gdi32

shell32

Exports

Exports

Sections

.text Size: 720KB - Virtual size: 717KB

.rdata Size: 76KB - Virtual size: 73KB

.data Size: 84KB - Virtual size: 708KB

.rsrc Size: 8KB - Virtual size: 4KB

.reloc Size: 56KB - Virtual size: 54KB

.text
Size: 720KB - Virtual size: 717KB

.rdata
Size: 76KB - Virtual size: 73KB

.data
Size: 84KB - Virtual size: 708KB

.rsrc
Size: 8KB - Virtual size: 4KB

.reloc
Size: 56KB - Virtual size: 54KB