f0a0c3d30b44d1073b1c786a35b6833d866610624e96a71e9c31698ba66d8780

Sharing

Copy URL Twitter E-mail

General

Target

f0a0c3d30b44d1073b1c786a35b6833d866610624e96a71e9c31698ba66d8780
Size

5.6MB
MD5

49411ca059f351b5df2000983d013d9f
SHA1

40ce5cd7050829e4af58051d406564903c8960b0
SHA256

f0a0c3d30b44d1073b1c786a35b6833d866610624e96a71e9c31698ba66d8780
SHA512

b64bfb24cc3c556ee8470dcf5abed9e5a25f02f91e319016ebd1c3ec1d8717d7b81d12c1f353060d0ecc72b2b80d37c550cba8123d43aefa19d2991ce84edeb7
SSDEEP

98304:/hDpqfxeq0xtlwOndIKz+ZkhEYSCrEY+q5GFeNUxJ6iPYhcVuxju/Kn:ZDpSeq0xtlwOndIcXELZsGOUxYiPOkGb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f0a0c3d30b44d1073b1c786a35b6833d866610624e96a71e9c31698ba66d8780

Files

f0a0c3d30b44d1073b1c786a35b6833d866610624e96a71e9c31698ba66d8780
.exe windows:6 windows x86 arch:x86

8fd983c940b7829753a94d545e935bb7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

NeXAS（マスター用）.pdb

Imports

kernel32

InitializeCriticalSectionEx
DeleteCriticalSection
FormatMessageA
LocalFree
GetNumaProcessorNodeEx
GetNumaHighestNodeNumber
VirtualUnlock
GetLargePageMinimum
VirtualProtect
GetCurrentProcessorNumberEx
K32GetProcessMemoryInfo
GetProcessTimes
GetEnvironmentVariableA
GetModuleHandleA
GetModuleFileNameA
GetLastError
GetVolumeInformationA
GetLogicalDrives
GetDriveTypeA
SetThreadExecutionState
GetSystemTimeAdjustment
Sleep
LoadLibraryA
DecodePointer
ReadProcessMemory
OpenProcess
lstrcpyA
IsDebuggerPresent
lstrcmpA
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
CreateMutexA
GetTempPathA
CreateFileA
CreateDirectoryA
SetCurrentDirectoryA
GetNativeSystemInfo
FindNextFileA
FindFirstFileA
FindClose
DisableThreadLibraryCalls
GetVersionExA
GetThreadPriority
MulDiv
CreateSemaphoreA
CreateEventA
WaitForSingleObject
ResetEvent
SetEvent
CloseHandle
MoveFileA
CopyFileA
RaiseException
GetProcAddress
FreeLibrary
GetLocalTime
VirtualFree
VirtualAlloc
GetSystemInfo
ReleaseSemaphore
DuplicateHandle
WriteConsoleW
SetEndOfFile
CreateFileW
HeapSize
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFileAttributesA
DeleteFileA
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetTimeZoneInformation
HeapReAlloc
SetConsoleCtrlHandler
SetFilePointerEx
GetFileSizeEx
GetFileType
HeapAlloc
HeapFree
GetCurrentThread
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
SetFileInformationByHandle
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitOnceExecuteOnce
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetSystemTimeAsFileTime
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetModuleHandleW
GetFileInformationByHandleEx
CreateSymbolicLinkW
WideCharToMultiByte
EncodePointer
MultiByteToWideChar
LCMapStringEx
GetLocaleInfoEx
GetStringTypeW
CompareStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
CreateEventW
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
InitializeSListHead
TerminateProcess
GetFileSize
FindResourceA
LoadResource
SizeofResource
LockResource
SetFilePointer
FreeResource
ReadFile
WriteFile
GetFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
FlushFileBuffers
GlobalAlloc
GlobalFree
GetFullPathNameA
CreateProcessA
GetExitCodeProcess
ReleaseMutex
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoA
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileSectionNamesA
GetPrivateProfileSectionA
WaitForMultipleObjects
SetThreadPriority
ResumeThread
lstrcpyW
InitializeCriticalSection
CreateThread
OutputDebugStringW
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
ExitThread
FreeLibraryAndExitThread
GetDateFormatW
GetTimeFormatW
GetTickCount

user32

MessageBoxA
SendMessageA
GetWindowRect
ShowCursor
GetSystemMetrics
SetWindowPos
SetCursorPos
ScreenToClient
IsRectEmpty
SetRectEmpty
PostQuitMessage
GetDC
UnregisterClassA
GetWindow
GetWindowLongA
CallWindowProcA
GetDoubleClickTime
GetCursorPos
ShowWindow
SetFocus
SetForegroundWindow
DestroyWindow
SetTimer
EnableWindow
UpdateWindow
SetActiveWindow
CloseWindow
OpenIcon
PostMessageA
GetWindowTextA
GetDlgItem
IsWindowEnabled
SetPropA
MapWindowPoints
GetPropA
IsWindow
IsDialogMessageA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
PeekMessageA
LoadAcceleratorsA
FillRect
LoadCursorA
RegisterClassA
CreateMDIWindowA
KillTimer
CreateDialogParamA
SendDlgItemMessageA
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
GetDlgItemInt
CheckDlgButton
CheckRadioButton
IsDlgButtonChecked
DialogBoxParamA
EndDialog
EnumDisplaySettingsA
EnumWindows
ChangeDisplaySettingsExA
ChangeDisplaySettingsA
GetWindowTextLengthA
EnumChildWindows
InvalidateRect
GetDesktopWindow
PostThreadMessageA
GetQueueStatus
wvsprintfA
wsprintfA
RegisterWindowMessageA
MsgWaitForMultipleObjects
DefMDIChildProcA
DefFrameProcA
SetWindowPlacement
GetWindowPlacement
MoveWindow
CreateWindowExA
GetMonitorInfoA
MonitorFromWindow
SetWindowLongA
ClipCursor
LoadIconA
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
GetParent
ClientToScreen
GetClientRect
EndPaint
BeginPaint
ReleaseCapture
SetCapture
GetKeyState
IsWindowVisible
DefWindowProcA
SetWindowTextA
ReleaseDC

gdi32

GetTextMetricsA
SelectObject
GetGlyphOutlineA
DeleteObject
CreateFontA
GetStockObject
EnumFontFamiliesA
CreateFontIndirectA
SetBkMode
SetTextColor
TextOutA
SetBkColor
GetBitmapDimensionEx
CreateCompatibleDC
GetDIBits
DeleteDC
StretchDIBits
BitBlt
SetStretchBltMode
SetBrushOrgEx
StretchBlt
AddFontMemResourceEx
RemoveFontMemResourceEx
GetDeviceCaps
CreateDIBSection

advapi32

LookupPrivilegeValueA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCreateKeyExA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegQueryValueExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegEnumValueA
OpenProcessToken
AdjustTokenPrivileges

shell32

Shell_NotifyIconA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ShellExecuteExA
SHGetMalloc
ShellExecuteA

winmm

timeBeginPeriod
timeGetDevCaps
timeGetTime
timeSetEvent
timeKillEvent
timeEndPeriod

dbghelp

MiniDumpWriteDump

shlwapi

ord219

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

dinput8

DirectInput8Create

mf

MFCreateMediaSession
MFCreateTopology
MFCreateAudioRendererActivate
MFCreateVideoRendererActivate
MFCreateTopologyNode
MFGetService

mfplat

MFStartup
MFCreateMFByteStreamOnStream
MFCreateSourceResolver
MFShutdown

msvfw32

MCIWndCreateA

wmvcore

WMCreateSyncReader

wininet

InternetOpenA
InternetCloseHandle
InternetReadFile
HttpQueryInfoA
InternetOpenUrlA

ole32

PropVariantClear
CoUninitialize
CoTaskMemAlloc
GetRunningObjectTable
CoTaskMemFree
CoSetProxyBlanket
CoCreateInstance
CoInitialize
CreateItemMoniker
CoFreeUnusedLibraries

oleaut32

SysFreeString
SysAllocString

bcrypt

BCryptGenRandom

Sections

.text
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 915KB - Virtual size: 915KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 202KB - Virtual size: 202KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8fd983c940b7829753a94d545e935bb7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

winmm

dbghelp

shlwapi

version

dinput8

mf

mfplat

msvfw32

wmvcore

wininet

ole32

oleaut32

bcrypt

Sections

.text Size: 4.4MB - Virtual size: 4.4MB

.rdata Size: 915KB - Virtual size: 915KB

.data Size: 76KB - Virtual size: 1.2MB

.rsrc Size: 202KB - Virtual size: 202KB

.text
Size: 4.4MB - Virtual size: 4.4MB

.rdata
Size: 915KB - Virtual size: 915KB

.data
Size: 76KB - Virtual size: 1.2MB

.rsrc
Size: 202KB - Virtual size: 202KB