88491f0864583854a621114dbf63039cecfd13570c12e49b8416577c96a67740

Sharing

Copy URL Twitter E-mail

General

Target

88491f0864583854a621114dbf63039cecfd13570c12e49b8416577c96a67740
Size

517KB
MD5

e4897feedaee6aab9674eafa0216438b
SHA1

39b690016cdaf637df1d6c12b7d8515f4f354379
SHA256

88491f0864583854a621114dbf63039cecfd13570c12e49b8416577c96a67740
SHA512

79796ca768608274b04f2aed1afbca8f9f739e32a46fc6700aeb2e2ffcff1523b96108125dee02d38316c010eff5c7c1ec1bbf6d01345f9263a15b62f6dc1a7b
SSDEEP

12288:PG2PsuW8YpzIbRGzsvXFOUCVjYP5cMZwf3C6cThlp2n2FGId/:PG2PsufYeRGzsvVK8P5HI3C64Lp2n2F1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
88491f0864583854a621114dbf63039cecfd13570c12e49b8416577c96a67740

Files

88491f0864583854a621114dbf63039cecfd13570c12e49b8416577c96a67740
.dll regsvr32 windows:5 windows x86 arch:x86

bbf27453bace8647d52608aa6bb00c68

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Project\EverCam10_clean\VC\fseditor\ReleaseUMinDependency\fseditor.pdb

Imports

kernel32

GetModuleFileNameW
DisableThreadLibraryCalls
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
SetLastError
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
VirtualAlloc
VirtualFree
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
MulDiv
WriteFile
GetFileType
SetHandleCount
HeapSize
GetLocaleInfoW
GetStdHandle
ExitProcess
HeapDestroy
HeapCreate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCommandLineA
VirtualQuery
GetSystemInfo
VirtualProtect
CreateThread
ExitThread
EncodePointer
GetCurrentProcess
FlushInstructionCache
lstrcmpiW
GetModuleHandleW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
CreateFileW
GetModuleFileNameA
CloseHandle
ReadFile
Sleep
OutputDebugStringA
FreeLibrary
GetFileSizeEx
SetFilePointerEx
LoadLibraryA
GetProcAddress
GetStartupInfoW
SetEndOfFile
CreateFileA
WriteConsoleW
DecodePointer
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
FlushFileBuffers
SetStdHandle
GetStringTypeW
LoadLibraryW
InterlockedExchange
HeapReAlloc
RtlUnwind
InterlockedPopEntrySList
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedPushEntrySList
InterlockedCompareExchange
GetTempPathA
GetTempFileNameA
QueryPerformanceFrequency
QueryPerformanceCounter
GetConsoleCP
GetConsoleMode
SetConsoleCtrlHandler
FatalAppExitA
SetFilePointer
LCMapStringW

user32

CreateWindowExW
RegisterClassExW
InvalidateRect
IsWindow
GetKeyState
GetParent
GetFocus
IsChild
SetFocus
UnregisterClassA
BeginPaint
GetClientRect
EndPaint
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
SetWindowPos
GetDC
ReleaseDC
LoadCursorW
GetClassInfoExW
ShowWindow
GetWindowLongW
SetWindowLongW
CharNextW
UnionRect
PtInRect
DefWindowProcW
DestroyWindow
PostMessageW
PeekMessageW
TranslateMessage
DispatchMessageW
MessageBoxA
CallWindowProcW

gdi32

SaveDC
SetMapMode
SetWindowOrgEx
SetViewportOrgEx
DeleteDC
RestoreDC
CreateDCW
CreateRectRgnIndirect
GetDeviceCaps
Rectangle
SetTextAlign
TextOutW
LPtoDP

advapi32

RegDeleteValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW

ole32

OleSaveToStream
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
OleRegGetUserType
StringFromGUID2
ReadClassStm
CoCreateInstance
OleRegEnumVerbs
WriteClassStm
CreateOleAdviseHolder
OleRegGetMiscStatus

oleaut32

OleCreatePropertyFrame
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
VariantChangeType
VariantClear
VariantInit
SysStringByteLen
SysAllocStringByteLen
SysStringLen
SysFreeString

xvidcore

xvid_global
xvid_encore
xvid_plugin_single
xvid_decore

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 422KB - Virtual size: 422KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bbf27453bace8647d52608aa6bb00c68

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

xvidcore

Exports

Exports

Sections

.text Size: 422KB - Virtual size: 422KB

.rdata Size: 56KB - Virtual size: 56KB

.data Size: 17KB - Virtual size: 27KB

.rsrc Size: 5KB - Virtual size: 5KB

.reloc Size: 14KB - Virtual size: 14KB

.text
Size: 422KB - Virtual size: 422KB

.rdata
Size: 56KB - Virtual size: 56KB

.data
Size: 17KB - Virtual size: 27KB

.rsrc
Size: 5KB - Virtual size: 5KB

.reloc
Size: 14KB - Virtual size: 14KB