ea561ef2482c25d0f7bf4c81300901f886b4195e9619b7fc65de621ccd0963c8

Sharing

Copy URL

Twitter E-mail

General

Target

ea561ef2482c25d0f7bf4c81300901f886b4195e9619b7fc65de621ccd0963c8
Size

84KB
MD5

646a96544b09cfc18d056bf3ce5651ea
SHA1

af90e815d8c59471d2acdd56452ac9ef88a3c38e
SHA256

ea561ef2482c25d0f7bf4c81300901f886b4195e9619b7fc65de621ccd0963c8
SHA512

11502671cc19338f0a6d7909a1b8951247108761f0d022b82f93b283efd37df7e2e4592eb47cbdb91135ba564ba9f4f312c65d60aa264341ad012b70948f1d8c
SSDEEP

1536:dyp+V3b1sD7XRGIrnxi0HBIpPp640Zsyb914:dyp+V3b1s/RGIrnxi0HBIpPp640ZsoX4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ea561ef2482c25d0f7bf4c81300901f886b4195e9619b7fc65de621ccd0963c8

Files

ea561ef2482c25d0f7bf4c81300901f886b4195e9619b7fc65de621ccd0963c8
.dll windows:4 windows x86 arch:x86

69a746e5c9a0d340f16a8a59e7c42fc3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\dev\servermain\Steam\src\drm_rel_ceg3.1\Release\survey.pdb

Imports

rpcrt4

UuidCreate

kernel32

LoadResource
FindResourceW
GetLastError
HeapAlloc
GetProcessHeap
HeapFree
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
CloseHandle
SizeofResource
GetFileInformationByHandle
CreateFileW
LockResource
FindNextFileW
FindFirstFileW
lstrcpyW
lstrcmpiW
GetVolumePathNameW
lstrlenW
GetWindowsDirectoryW
GetSystemDirectoryW
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
DeleteCriticalSection
DebugBreak
LocalFree
FindClose

version

VerQueryValueW

advapi32

RegQueryValueExW
GetSecurityInfo
ConvertStringSidToSidA
GetAce
RegCreateKeyExW
RegSetValueW
RegCloseKey
RegOpenKeyExW
GetAclInformation
EqualSid

ole32

StringFromGUID2

Exports

Exports

_runfunc@20

Sections

.text
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cegm
Size: 4KB - Virtual size: 39B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 732B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

69a746e5c9a0d340f16a8a59e7c42fc3

Headers

File Characteristics

PDB Paths

Imports

rpcrt4

kernel32

version

advapi32

ole32

Exports

Exports

Sections

.text Size: 52KB - Virtual size: 49KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 4KB - Virtual size: 328B

.cegm Size: 4KB - Virtual size: 39B

.rsrc Size: 4KB - Virtual size: 732B

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 52KB - Virtual size: 49KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 328B

.cegm
Size: 4KB - Virtual size: 39B

.rsrc
Size: 4KB - Virtual size: 732B

.reloc
Size: 8KB - Virtual size: 6KB