4[.]0[.]1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

4.0.1.exe
Size

546KB
MD5

2b3a7c4110862be2f6c19c9f9418b9a6
SHA1

ace99fbd649c9d2f4f5c3ca54e81efeacef48a23
SHA256

3a9ab6d56df5b7d851936f1b3c1bbaf561b939ba013b9018ddab5f5603a83c76
SHA512

b177df1ee909a322bb7cc8ea0ec79e82f12ad938b692c29aea147a298967e7c2d2007d3c83542b8db2e817af3463f72376416cab7cd1c96624ddbc88f45486e4
SSDEEP

12288:8X0pAyZwcEXoZjUWK97oxgb2ouumnBNB:HyGUjux2zvmn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4.0.1.exe

Files

4.0.1.exe
.exe windows:6 windows x64 arch:x64

6838f519297f9aaa82c61a24735a6d90

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\artsu\OneDrive\Asztali gép\PPP\v4 src - Copy\x64\Release\ImGui Loader base.pdb

Imports

user32

GetClipboardData
PeekMessageA
PostQuitMessage
UpdateWindow
GetWindowLongW
AdjustWindowRectEx
GetKeyState
LoadCursorA
DestroyWindow
GetDC
SetWindowPos
MonitorFromWindow
EnumDisplayMonitors
ScreenToClient
SetWindowTextW
WindowFromPoint
ShowWindow
GetCapture
SetWindowLongA
ClientToScreen
IsChild
GetMonitorInfoA
DefWindowProcA
CreateWindowExA
SetLayeredWindowAttributes
SetFocus
BringWindowToTop
SetCapture
SetCursor
SetWindowLongW
GetClientRect
UnregisterClassA
RegisterClassExA
ReleaseCapture
SetForegroundWindow
IsIconic
SetCursorPos
ReleaseDC
GetCursorPos
OpenClipboard
CloseClipboard
SetClipboardData
GetWindowTextLengthW
FindWindowA
TranslateMessage
UnhookWindowsHookEx
GetForegroundWindow
GetWindowRect
GetAsyncKeyState
GetDesktopWindow
GetWindowTextW
GetMessageA
DispatchMessageA
PostMessageA
CallNextHookEx
SetWindowsHookExA
EmptyClipboard

gdi32

GetDeviceCaps

kernel32

ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetModuleHandleW
RtlLookupFunctionEntry
InitializeSListHead
VerifyVersionInfoW
FreeLibrary
VerSetConditionMask
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
CreateThread
Sleep
RtlVirtualUnwind
QueryPerformanceCounter

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

imm32

ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow

d3d9

Direct3DCreate9

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException
__current_exception
memmove
memcpy
memset
__C_specific_handler
strstr
__std_exception_copy
__std_exception_destroy
__std_terminate
memchr
memcmp
__current_exception_context

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-heap-l1-1-0

malloc
_callnewh
free
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

_cexit
_seh_filter_exe
_set_app_type
_crt_atexit
_get_narrow_winmain_command_line
_initterm
_initterm_e
exit
_exit
_invalid_parameter_noinfo_noreturn
_c_exit
_register_thread_local_exe_atexit_callback
_register_onexit_function
terminate
_wassert
_initialize_onexit_table
_configure_narrow_argv
_initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_wfopen
__stdio_common_vsprintf
__stdio_common_vsscanf
fwrite
fseek
fclose
fflush
__acrt_iob_func
__p__commode
ftell
_set_fmode
fread

api-ms-win-crt-string-l1-1-0

strcmp
strncmp
strncpy

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

fmodf
ceilf
cosf
sinf
acosf
sqrtf
__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 335KB - Virtual size: 334KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 188KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6838f519297f9aaa82c61a24735a6d90

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

gdi32

kernel32

msvcp140

imm32

d3d9

vcruntime140_1

vcruntime140

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 335KB - Virtual size: 334KB

.rdata Size: 188KB - Virtual size: 187KB

.data Size: 5KB - Virtual size: 22KB

.pdata Size: 15KB - Virtual size: 14KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1024B - Virtual size: 972B

.text
Size: 335KB - Virtual size: 334KB

.rdata
Size: 188KB - Virtual size: 187KB

.data
Size: 5KB - Virtual size: 22KB

.pdata
Size: 15KB - Virtual size: 14KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1024B - Virtual size: 972B