d69df7c415a0a4c755dd9cfe3ca00ab0ae87a3fed44b8e0f823ec249d099d43f

Sharing

Copy URL Twitter E-mail

General

Target

d69df7c415a0a4c755dd9cfe3ca00ab0ae87a3fed44b8e0f823ec249d099d43f
Size

793KB
MD5

1f1d47974157f7625d58fd8fa4adb3e4
SHA1

a3e8b700471fa7cff251ed4954ed9536490054f2
SHA256

d69df7c415a0a4c755dd9cfe3ca00ab0ae87a3fed44b8e0f823ec249d099d43f
SHA512

75b82316863bfbab1f6a1eb6ccef48ba9dbce964c47569f6cc567825b475b9657f929cec86c3808130a27103a2e39f1c1a8b3ed102af76c123ec2dff01626218
SSDEEP

6144:V1mlh2mjJJCAubnB2Zo8aToRv27l8wmR9+9tSghTbMVNqT8oxgOCzHD:V4lhD2pbnwZKTeaUoHh3MVsAo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d69df7c415a0a4c755dd9cfe3ca00ab0ae87a3fed44b8e0f823ec249d099d43f

Files

d69df7c415a0a4c755dd9cfe3ca00ab0ae87a3fed44b8e0f823ec249d099d43f
.dll windows:6 windows x64 arch:x64

327586153ffb0510c6d1459b7c0fbd6b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Dosyalar\C3 Source\Bin64\CryInput.pdb

Imports

dinput8

DirectInput8Create

kernel32

GetFileAttributesExA
SetFileAttributesA
IsDebuggerPresent
DebugBreak
OutputDebugStringA
CloseHandle
QueryPerformanceCounter
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
CreateMutexA
CreateEventA
SignalObjectAndWait
InitializeSListHead
CreateDirectoryW
InterlockedPushEntrySList
InterlockedFlushSList
GetCurrentThreadId
ResumeThread
GetModuleFileNameW
GetProcAddress
CreateSemaphoreA
LoadLibraryA
EncodePointer
IsProcessorFeaturePresent
GetCurrentDirectoryA
GetModuleHandleW
FreeLibrary
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCurrentProcessId
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryW
lstrlenA
LoadLibraryExW
GetLastError
RaiseException
DecodePointer
SetCurrentDirectoryW
Sleep
GetModuleHandleA
InterlockedPopEntrySList

user32

CallWindowProcA
ToUnicode
GetRawInputData
GetDesktopWindow
ShowCursor
MessageBoxA
GetWindowRect
SetWindowTextA
GetAsyncKeyState
GetDlgItem
EndDialog
DialogBoxIndirectParamA
SetWindowPos
MapVirtualKeyExA
ToAsciiEx
GetKeyState
GetKeyboardLayout
ToUnicodeEx

advapi32

RegQueryValueExA
RegCreateKeyExA
RegCloseKey
RegSetValueExA

msvcp110d

?_Xbad_alloc@std@@YAXXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Debug_message@std@@YAXPEB_W0I@Z
??0_Container_base12@std@@QEAA@XZ
??1_Container_base12@std@@QEAA@XZ
?_Getpfirst@_Container_base12@std@@QEBAPEAPEAU_Iterator_base12@2@XZ
?_Orphan_all@_Container_base12@std@@QEAAXXZ
?_Swap_all@_Container_base12@std@@QEAAXAEAU12@@Z
?_Winerror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z

msvcr110d

_ltoa
fabs
asinf
atan2f
_purecall
_vswprintf_c_l
memset
_invalid_parameter
_CrtDbgReportW
memmove
memcpy
strlen
_CxxThrowException
__CxxFrameHandler3
_vsnprintf
_vscprintf
strcmp
abs
sqrtf
_CrtMemCheckpoint
_CrtMemDifference
_set_purecall_handler
_set_invalid_parameter_handler
exit
atof
_i64toa
_ui64toa
wcstombs
powf
sscanf_s
sprintf
strchr
strcspn
strrchr
??0exception@std@@QEAA@AEBQEBDH@Z
??1exception@std@@UEAA@XZ
isupper
islower
isspace
isalnum
_beginthreadex
raise
?what@exception@std@@UEBAPEBDXZ
_CRT_RTC_INITW
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtCaptureCurrentContext
__crtCapturePreviousContext
_lock
_unlock
_calloc_dbg
__dllonexit
__C_specific_handler
_onexit
_vsnprintf_s
__CppXcptFilter
_amsg_exit
_malloc_dbg
_free_dbg
_CrtSetCheckCount
_initterm
_initterm_e
__clean_type_info_names_internal
wcscpy_s
_wmakepath_s
_wsplitpath_s
_ultoa
_stricmp
_strnicmp

xinput9_1_0

XInputSetState
XInputGetCapabilities
XInputGetState

Exports

Exports

?CryCrtFree@@YA_KPEAX@Z
?CryCrtMalloc@@YAPEAX_K@Z
?CryCrtSize@@YA_KPEAX@Z
?CryModuleMemSize@@YA_KPEAX_K@Z
?gEnv@@3PEAUSSystemGlobalEnvironment@@EA
CheckPoint
CryGetMemoryInfoForModule
CryModuleCalloc
CryModuleFree
CryModuleGetMemoryInfo
CryModuleMalloc
CryModuleMemalign
CryModuleMemalignFree
CryModuleRealloc
CryModuleReallocAlign
ModuleInitISystem
UsageSummary

Sections

.text
Size: 579KB - Virtual size: 578KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 143KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 265B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

327586153ffb0510c6d1459b7c0fbd6b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

dinput8

kernel32

user32

advapi32

msvcp110d

msvcr110d

xinput9_1_0

Exports

Exports

Sections

.text Size: 579KB - Virtual size: 578KB

.rdata Size: 143KB - Virtual size: 142KB

.data Size: 11KB - Virtual size: 31KB

.pdata Size: 40KB - Virtual size: 40KB

.idata Size: 8KB - Virtual size: 8KB

.tls Size: 512B - Virtual size: 265B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 579KB - Virtual size: 578KB

.rdata
Size: 143KB - Virtual size: 142KB

.data
Size: 11KB - Virtual size: 31KB

.pdata
Size: 40KB - Virtual size: 40KB

.idata
Size: 8KB - Virtual size: 8KB

.tls
Size: 512B - Virtual size: 265B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 6KB