527f8563c48baae6200525d44353bfb67731c68dd744aaabba9e603e88caf246

Sharing

Copy URL Twitter E-mail

General

Target

527f8563c48baae6200525d44353bfb67731c68dd744aaabba9e603e88caf246
Size

836KB
MD5

5fdcc15c91f5b1a5ffa8967f34745786
SHA1

9249a1de8748d56b62b84abea5b593c62d5fe51f
SHA256

527f8563c48baae6200525d44353bfb67731c68dd744aaabba9e603e88caf246
SHA512

1dcac878ce1fa49de643c90a7757bf6c5bcb71e5a62bbfdaca0640e8eef067a4760f7d933ff2423d571f9500c12e91b55764541824a9d3b43e45459b61158d83
SSDEEP

24576:a/bNGlz8Da3AGMxalY8bGDvIAT7ZUbsrR1uJYYilog:apIz8Da3ualt8QAT7ZUbsrR1uD

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
527f8563c48baae6200525d44353bfb67731c68dd744aaabba9e603e88caf246

Files

527f8563c48baae6200525d44353bfb67731c68dd744aaabba9e603e88caf246
.exe windows:6 windows x64 arch:x64

e6e2a972f850eabe26bee7fd711bdd7c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\GitHub\Visual Studio\StandKnife-AntiCheat-PC\StandKnife\x64\Release\StandKnife.pdb

Imports

kernel32

GetThreadContext
ResumeThread
SuspendThread
OpenThread
GetCurrentThreadId
GetCurrentProcess
HeapFree
HeapReAlloc
HeapAlloc
HeapCreate
GetFileSizeEx
VerifyVersionInfoW
VerSetConditionMask
SleepEx
FlushInstructionCache
VirtualProtect
GetCurrentProcessId
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
Thread32First
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExW
Sleep
GetModuleHandleW
FreeLibrary
GetSystemDirectoryW
QueryPerformanceFrequency
CreateEventW
WaitForSingleObject
SetEvent
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetTickCount
QueryPerformanceCounter
Thread32Next
GetSystemInfo
FormatMessageW
SetLastError
GetLastError
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
SetThreadContext
WideCharToMultiByte
MultiByteToWideChar
GetProcAddress
CloseHandle
Process32Next
CreateToolhelp32Snapshot
Process32First
InitializeSListHead
LoadLibraryW
LoadLibraryA
GetSystemTimeAsFileTime
GetStartupInfoW
VirtualQuery
CreateFileW
GetModuleHandleA
FindClose
FindNextFileA
IsDebuggerPresent
IsProcessorFeaturePresent
FindFirstFileA
TerminateProcess
GetStdHandle
VirtualFree
VirtualAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter

user32

GetWindowTextA
GetWindow
GetTopWindow
MessageBoxA

advapi32

CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
GetUserNameA
CryptAcquireContextW

msvcp140

?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_detach
_Query_perf_counter
_Cnd_do_broadcast_at_thread_exit
_Query_perf_frequency
?_Xlength_error@std@@YAXPEBD@Z

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context
_CxxThrowException
__current_exception
__std_exception_destroy
memmove
memcpy
__std_exception_copy
memset
__C_specific_handler
strchr
strrchr
memchr
strstr
memcmp
wcschr

api-ms-win-crt-heap-l1-1-0

malloc
free
calloc
_callnewh
_set_new_mode
realloc

api-ms-win-crt-runtime-l1-1-0

__sys_errlist
__sys_nerr
_cexit
_invalid_parameter_noinfo_noreturn
_crt_atexit
_beginthreadex
_seh_filter_exe
_register_onexit_function
_errno
_initialize_onexit_table
_set_app_type
_initialize_narrow_environment
_get_narrow_winmain_command_line
_configure_narrow_argv
_initterm_e
exit
_initterm
_exit
_c_exit
_register_thread_local_exe_atexit_callback
terminate

api-ms-win-crt-string-l1-1-0

strlen
wcspbrk
_wcsdup
_strdup
strcspn
wcsncpy
strpbrk
wcsncmp
tolower
strcmp
strspn
strncmp

api-ms-win-crt-stdio-l1-1-0

_wopen
_read
_set_fmode
_write
_fileno
_close
_wfopen
__p__commode
fflush
__stdio_common_vsprintf
fputc
__acrt_iob_func
__stdio_common_vsscanf
fread
fwrite
fclose
fputs
__stdio_common_vswprintf
feof
fseek
_fseeki64
_lseeki64
fgets
ftell

api-ms-win-crt-convert-l1-1-0

wcstombs
strtoll
atoi
strtol
strtoul

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

strftime
_gmtime64
_time64

api-ms-win-crt-filesystem-l1-1-0

_waccess
_wstat64
_unlink
_fstat64

api-ms-win-crt-math-l1-1-0

_fdopen
__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

ws2_32

recvfrom
gethostname
recv
sendto
getpeername
ioctlsocket
getsockopt
send
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
closesocket
WSASetLastError
WSAGetLastError
inet_pton
ntohs
inet_ntop
WSAStartup
WSACleanup
setsockopt
WSAIoctl
htons
socket
__WSAFDIsSet
select
accept
bind
connect
getsockname
htonl
listen
freeaddrinfo
getaddrinfo

crypt32

CertAddCertificateContextToStore
CertGetNameStringW
CryptDecodeObjectEx
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
PFXImportCertStore
CryptStringToBinaryW
CertFreeCertificateContext
CertFindCertificateInStore
CertOpenStore
CertEnumCertificatesInStore
CertCloseStore
CertFindExtension
CryptQueryObject

Exports

Exports

AmdPowerXpressRequestHighPerformance
NvOptimusEnablement

Sections

.text
Size: 429KB - Virtual size: 428KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 265KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e6e2a972f850eabe26bee7fd711bdd7c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

msvcp140

bcrypt

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

ws2_32

crypt32

Exports

Exports

Sections

.text Size: 429KB - Virtual size: 428KB

.rdata Size: 113KB - Virtual size: 112KB

.data Size: 3KB - Virtual size: 4KB

.pdata Size: 23KB - Virtual size: 22KB

.rsrc Size: 265KB - Virtual size: 264KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 429KB - Virtual size: 428KB

.rdata
Size: 113KB - Virtual size: 112KB

.data
Size: 3KB - Virtual size: 4KB

.pdata
Size: 23KB - Virtual size: 22KB

.rsrc
Size: 265KB - Virtual size: 264KB

.reloc
Size: 2KB - Virtual size: 1KB