feba44415c81e1ac1cb5e6d211d27cbabda071c603a01565a552d2b955f3b53a

Sharing

Copy URL Twitter E-mail

General

Target

feba44415c81e1ac1cb5e6d211d27cbabda071c603a01565a552d2b955f3b53a
Size

19KB
MD5

cb6ccede5e0a9162dc37c9b008754152
SHA1

23abb59c4d48e69f7fea7ecb90384bcfdc52db5e
SHA256

feba44415c81e1ac1cb5e6d211d27cbabda071c603a01565a552d2b955f3b53a
SHA512

63e6422478ede2c981d7e833be391c33fd99c410056467d8b4738416d570bd7d5e5eb4726440758461268a5415b5d90531213b2be568e8d408dd96a77c6192ae
SSDEEP

384:ZPPp7hAQ2YKSdbj1NRo8sFjkaNOGyHp4om:NJhAhOxNRotCakG7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
feba44415c81e1ac1cb5e6d211d27cbabda071c603a01565a552d2b955f3b53a

Files

feba44415c81e1ac1cb5e6d211d27cbabda071c603a01565a552d2b955f3b53a
.dll windows:6 windows x86 arch:x86

f6dc3f7e294cdb5cbd44e3c44d4be43b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

VirtualProtect
GetModuleHandleA
MultiByteToWideChar
WideCharToMultiByte
EnterCriticalSection
CloseHandle
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
LeaveCriticalSection

user32

MessageBoxA

msvcp140

?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z

vcruntime140

memmove
__std_exception_copy
memset
_except_handler4_common
__std_type_info_destroy_list
_CxxThrowException
__std_exception_destroy
memcpy

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm
_cexit
_crt_atexit
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_execute_onexit_table

api-ms-win-crt-string-l1-1-0

wcscpy_s
strcpy_s

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh

Exports

Exports

AddFlag
BaseGameFixes
EnDecrypt
GetEntityPointer
GetGameRulesProxyPointer
GetListenServerHostOid
GetPlayerResourcePointer
HandleToIndex
IsFlagSet
IsInGame
LockMemProt
LuaInit
MemWriteString
MemWriteWString
RemoveFlag
StringToWString
UnlockMemProt
Utf8Length
Utf8Substring
WStringToString
ZombieEscapePatches
luaopen_dounai_lib

Sections

.97osx
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.xduhyat
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_MEM_READ

.6y43
Size: 512B - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.yoa0
Size: 512B - Virtual size: 248B

IMAGE_SCN_MEM_READ

.851tdrk
Size: 1024B - Virtual size: 904B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f6dc3f7e294cdb5cbd44e3c44d4be43b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

Exports

Exports

Sections

.97osx Size: 11KB - Virtual size: 10KB

.xduhyat Size: 5KB - Virtual size: 4KB

.6y43 Size: 512B - Virtual size: 1KB

.yoa0 Size: 512B - Virtual size: 248B

.851tdrk Size: 1024B - Virtual size: 904B

.97osx
Size: 11KB - Virtual size: 10KB

.xduhyat
Size: 5KB - Virtual size: 4KB

.6y43
Size: 512B - Virtual size: 1KB

.yoa0
Size: 512B - Virtual size: 248B

.851tdrk
Size: 1024B - Virtual size: 904B