572b3fbe6c29be35a47dfa8e78b03b7a2375fd275a06b0a137acaac1ca6de826

Sharing

Copy URL

Twitter E-mail

General

Target

572b3fbe6c29be35a47dfa8e78b03b7a2375fd275a06b0a137acaac1ca6de826
Size

599KB
MD5

9ead659345e83cd4034df67a86eefecb
SHA1

2ab19842749969c633bcc1e00e988a860f7feabf
SHA256

572b3fbe6c29be35a47dfa8e78b03b7a2375fd275a06b0a137acaac1ca6de826
SHA512

6423e2de8a10a294d20fd99167408cd4e3eec628c335814c82d40486dd5cd48a56d57dbd74d42111fd2901711aa9d4bebe09d5cf873f9d231fe43f542da9ec75
SSDEEP

12288:iaDXJ2/SZqeXILbbR8m117NTInWCBK//3djiErA0knb:bYLbbP112hk39rrhkb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
572b3fbe6c29be35a47dfa8e78b03b7a2375fd275a06b0a137acaac1ca6de826

Files

572b3fbe6c29be35a47dfa8e78b03b7a2375fd275a06b0a137acaac1ca6de826
.dll windows:6 windows x86 arch:x86

0b7e1ef13bf19e016e4e5fcc769a9914

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\research_liveplay\xweb_liveplayer\Release\xweb_liveplayer.pdb

Imports

kernel32

GetModuleFileNameA
GetModuleHandleExW
LoadLibraryExA
MultiByteToWideChar
GetLastError
GetProcAddress
FreeLibrary
GetTickCount
GetModuleFileNameW
GetFileAttributesW
GetCurrentThreadId
OutputDebugStringW
GetLocalTime
GetCurrentProcessId
VirtualQuery
WideCharToMultiByte
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
CreateDirectoryW
EnterCriticalSection
SetEndOfFile
HeapSize
CreateFileW
WriteConsoleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
DecodePointer
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlUnwind
RaiseException
LoadLibraryExW
InterlockedFlushSList
ReadFile
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
GetACP
GetStdHandle
GetFileType
SetFilePointerEx
GetConsoleMode
ReadConsoleW
FlushFileBuffers
WriteFile
GetConsoleCP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle

shell32

SHGetFolderPathW

shlwapi

PathFileExistsW

Exports

Exports

??0CxFile@@QAE@ABV0@@Z
??0CxFile@@QAE@XZ
??0CxIOFile@@QAE@ABV0@@Z
??0CxIOFile@@QAE@PAU_iobuf@@@Z
??0CxMemFile@@QAE@ABV0@@Z
??1CxFile@@UAE@XZ
??1CxIOFile@@UAE@XZ
??1CxImage@@UAE@XZ
??4CxFile@@QAEAAV0@ABV0@@Z
??4CxIOFile@@QAEAAV0@ABV0@@Z
??4CxMemFile@@QAEAAV0@ABV0@@Z
??_7CxFile@@6B@
??_7CxIOFile@@6B@
??_7CxImage@@6B@
??_7CxMemFile@@6B@
??_FCxIOFile@@QAEXXZ
??_FCxImage@@QAEXXZ
??_FCxMemFile@@QAEXXZ
??_OCxImage@@QAEXAAV0@@Z
?Close@CxIOFile@@UAE_NXZ
?Eof@CxIOFile@@UAE_NXZ
?Error@CxIOFile@@UAEHXZ
?Flush@CxIOFile@@UAE_NXZ
?GetC@CxIOFile@@UAEHXZ
?GetS@CxIOFile@@UAEPADPADH@Z
?Open@CxIOFile@@QAE_NPB_W0@Z
?PutC@CxFile@@UAE_NE@Z
?PutC@CxIOFile@@UAE_NE@Z
?Read@CxIOFile@@UAEIPAXII@Z
?Scanf@CxIOFile@@UAEHPBDPAX@Z
?Seek@CxIOFile@@UAE_NHH@Z
?Size@CxIOFile@@UAEHXZ
?Tell@CxIOFile@@UAEHXZ
?Write@CxIOFile@@UAEIPBXII@Z
PPP_GetInterface
PPP_InitializeModule
PPP_ShutdownModule

Sections

.text
Size: 431KB - Virtual size: 431KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 13B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 600B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0b7e1ef13bf19e016e4e5fcc769a9914

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shell32

shlwapi

Exports

Exports

Sections

.text Size: 431KB - Virtual size: 431KB

.rdata Size: 111KB - Virtual size: 111KB

.data Size: 6KB - Virtual size: 19KB

.tls Size: 512B - Virtual size: 13B

.gfids Size: 1024B - Virtual size: 600B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 33KB - Virtual size: 33KB

.text
Size: 431KB - Virtual size: 431KB

.rdata
Size: 111KB - Virtual size: 111KB

.data
Size: 6KB - Virtual size: 19KB

.tls
Size: 512B - Virtual size: 13B

.gfids
Size: 1024B - Virtual size: 600B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 33KB - Virtual size: 33KB