E:\BuildAgent\work.custom\BranchBuilds_RC6\Version_LocKit\LocKitBinaries\GameCenterPlugin.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ed25f8ab7a888e1fa4b224f2304ce2e0_NEAS.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ed25f8ab7a888e1fa4b224f2304ce2e0_NEAS.dll
Resource
win10v2004-20240419-en
General
-
Target
ed25f8ab7a888e1fa4b224f2304ce2e0_NEAS
-
Size
1.7MB
-
MD5
ed25f8ab7a888e1fa4b224f2304ce2e0
-
SHA1
1c43784a5173c6fb59da8c7bab9fe05ffaaf7d90
-
SHA256
94d4e1ba382aa1cdebf1b07fd413aa9c80acf1e369f896191f751f11e0e5dd2a
-
SHA512
4b5a5a6e8ad7bcf0b5df0ba97fd076029d7a897ebf1adcd36444ee2810779b3bae3013d1583e5ff2f0667f1f1f37a146d6b49de36348601bdf0cadcbd5bc80a8
-
SSDEEP
49152:sFGueXv7CqXzQARav+SplPUS2v3LxscZ+w81nDP:MeXLXUmNv7N+rND
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ed25f8ab7a888e1fa4b224f2304ce2e0_NEAS
Files
-
ed25f8ab7a888e1fa4b224f2304ce2e0_NEAS.dll windows:5 windows x86 arch:x86
82a4e845d0daadce696afac124d5b3f0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
d3d9
Direct3DCreate9
iphlpapi
GetAdaptersInfo
setupapi
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
kernel32
GetProcessHeap
FindFirstFileW
InitializeCriticalSection
InterlockedCompareExchange
SetEnvironmentVariableA
CompareStringW
IsValidLocale
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameW
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
CreateDirectoryA
GetProcAddress
CloseHandle
CreateFileA
CreateFileW
CreateDirectoryW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
Sleep
TryEnterCriticalSection
SetEvent
ResetEvent
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
GetCurrentProcessId
WideCharToMultiByte
GetACP
MultiByteToWideChar
GetCurrentDirectoryW
GetLongPathNameW
GetSystemDirectoryW
GetTempPathW
ExpandEnvironmentStringsW
GetLogicalDriveStringsW
GetSystemTimeAsFileTime
CreateEventW
WaitForSingleObject
SetThreadPriority
GetExitCodeThread
TlsGetValue
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
GetEnvironmentVariableW
SetEnvironmentVariableW
GetVersionExA
GetVersionExW
GetSystemInfo
GetComputerNameW
GetLastError
GetFileAttributesW
GetFileAttributesExW
SetFileTime
SetEndOfFile
SetFilePointer
SetFileAttributesW
CopyFileW
MoveFileW
DeleteFileW
RemoveDirectoryW
GetTimeZoneInformation
EnumSystemLocalesA
FindClose
FindNextFileW
CreateMutexW
ReleaseMutex
WaitForMultipleObjects
ReadFile
WriteFile
DecodePointer
GetCommandLineA
EncodePointer
RaiseException
RtlUnwind
HeapFree
HeapReAlloc
ExitThread
CreateThread
HeapAlloc
GetModuleHandleW
SetLastError
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
HeapSize
GetLocaleInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetStringTypeW
GetCPInfo
GetOEMCP
IsValidCodePage
LoadLibraryW
WriteConsoleW
SetStdHandle
LCMapStringW
GetUserDefaultLCID
GetLocaleInfoA
user32
wsprintfW
LoadStringW
ole32
CoInitializeEx
CoUninitialize
Exports
Exports
CreateLaunchArguments
CreateLaunchExe
DeinitializeGCPlugin
GetAPIVersion
GetAppExitMessage
InGCCall
InitializeGCPlugin
IsGlobalCFGDownloaded
OutGCCall
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 188KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 21KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 452KB - Virtual size: 452KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 65KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ