logs[.]log | Triage

Sharing

Copy URL Twitter E-mail

General

Target

logs.log
Size

2.8MB
MD5

4803c5744a27d6e3873ac06689336be2
SHA1

a464f4a16277dd45ffe2a3157576e45a083fd7a2
SHA256

d41cf836824a7eb51f0f6e11b00a4cbe445362fc31f125e0c4bc75352227d053
SHA512

557091d1be70e0269febc9695712a818ac7c46b76fed0f0014f0e727a94119027dee50b28d8109eae1b8ec42b056b9081f5f75aec87ed9d1646c17c7176bce21
SSDEEP

49152:4/Xq2m+MCU9dea4jzIz5poADASJnknpSnrNY8kIgIFch7zlYAHZ/ZA3+kN5mhN83:sU9dea4jzIz5poADASJnknpSnrNY8kID

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
logs.log

Files

logs.log
.dll windows:6 windows x64 arch:x64

af03a8867e914e32b35aca35fe8f4eed

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\desco\Мой компьютер\seregahack\SeregaRealise\seregahack.free.pdb

Imports

kernel32

LockResource
HeapReAlloc
RaiseException
WritePrivateProfileStringA
CreateThread
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
HeapDestroy
GetProcAddress
DeleteCriticalSection
GetProcessHeap
WideCharToMultiByte
CreateDirectoryA
GetPrivateProfileStringA
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LoadLibraryA
QueryPerformanceFrequency
QueryPerformanceCounter
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
VirtualProtect
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
GetModuleHandleA
Sleep
GetThreadContext
FlushInstructionCache
SetThreadContext
OpenThread
FormatMessageA
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetFileSizeEx
CreateFileA
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
TerminateProcess
InitializeSListHead
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetFileInformationByHandleEx
AreFileApisANSI
InitializeCriticalSectionEx
HeapFree
SizeofResource
MultiByteToWideChar
GetModuleFileNameW
lstrlenW
WaitNamedPipeW
GetCurrentProcessId
CloseHandle
GetLastError
CreateFileW
HeapSize
PeekNamedPipe
WriteFile
ReadFile
CreateToolhelp32Snapshot
GetLocaleInfoEx
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
LocalFree

user32

SetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
GetWindowThreadProcessId
IsWindowUnicode
CallWindowProcW
GetClientRect
SetCursor
SetCapture
LoadCursorW
GetForegroundWindow
TrackMouseEvent
SetWindowLongPtrW
GetSystemMetrics
EnumWindows
GetKeyState
GetMessageExtraInfo
GetCursorPos
GetAsyncKeyState
ClientToScreen
GetCapture
ScreenToClient
ReleaseCapture

advapi32

RegSetValueExW
RegCreateKeyExW
RegCloseKey

msvcp140

?_Xbad_function_call@std@@YAXXZ
_Cnd_init_in_situ
_Query_perf_frequency
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_timedwait
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
_Xtime_get_ticks
_Mtx_unlock
_Cnd_broadcast
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

wininet

InternetCloseHandle
InternetReadFile
InternetOpenA
InternetOpenUrlA

winmm

PlaySoundA

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

imm32

ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
ImmSetCandidateWindow

d3dcompiler_43

D3DCompile

vcruntime140

__C_specific_handler
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__std_type_info_destroy_list
__intrinsic_setjmp
memcmp
memchr
memcpy
longjmp
strrchr
memmove
memset
strstr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

fflush
fclose
fwrite
fread
ftell
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vswprintf
__stdio_common_vsscanf
_wfopen
__stdio_common_vsprintf_s
__stdio_common_vsprintf
fseek

api-ms-win-crt-filesystem-l1-1-0

remove

api-ms-win-crt-runtime-l1-1-0

terminate
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_seh_filter_dll
abort
_invalid_parameter_noinfo
system
_errno
_initterm
_beginthreadex
_initterm_e

api-ms-win-crt-utility-l1-1-0

qsort
rand

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh

api-ms-win-crt-convert-l1-1-0

strtol
atoi
atof

api-ms-win-crt-string-l1-1-0

strncmp
strcmp
strncpy

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

api-ms-win-crt-math-l1-1-0

powf
fmodf
cos
atan2f
atan2
asinf
acosf

Sections

.text
Size: 1001KB - Virtual size: 1000KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 600KB - Virtual size: 600KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.2MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

af03a8867e914e32b35aca35fe8f4eed

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

msvcp140

d3dx11_43

wininet

winmm

ntdll

imm32

d3dcompiler_43

vcruntime140

vcruntime140_1

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: 1001KB - Virtual size: 1000KB

.rdata Size: 600KB - Virtual size: 600KB

.data Size: 1.2MB - Virtual size: 1.4MB

.pdata Size: 34KB - Virtual size: 33KB

_RDATA Size: 9KB - Virtual size: 8KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 1001KB - Virtual size: 1000KB

.rdata
Size: 600KB - Virtual size: 600KB

.data
Size: 1.2MB - Virtual size: 1.4MB

.pdata
Size: 34KB - Virtual size: 33KB

_RDATA
Size: 9KB - Virtual size: 8KB

.reloc
Size: 4KB - Virtual size: 3KB