8760d61b74d919d85059ebbf41767b66240447f7198be21ef2e31d9bd1e93f11

Sharing

Copy URL Twitter E-mail

General

Target

8760d61b74d919d85059ebbf41767b66240447f7198be21ef2e31d9bd1e93f11
Size

21KB
MD5

ed1a98616c5bf9977e32041daddbf1aa
SHA1

5560165e78fabf265192bf4c7bd85a7a4d343d13
SHA256

8760d61b74d919d85059ebbf41767b66240447f7198be21ef2e31d9bd1e93f11
SHA512

1f4f97cbc828d063d85bc69696c19a475040b2d99744cd620bfd7cf7b2495b393e949b2f2c58403f4f76569fe78e484db9cb40ee458336e926a0922ad5679e39
SSDEEP

384:4/89jtWpAe78SxDmgPT+RSVG1fXuBCpKm473If2JvDjoRER7dZSzuPeoZq:4/8TWpRo1B40uxP/PZBPeQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8760d61b74d919d85059ebbf41767b66240447f7198be21ef2e31d9bd1e93f11

Files

8760d61b74d919d85059ebbf41767b66240447f7198be21ef2e31d9bd1e93f11
.dll windows:6 windows x86 arch:x86

d2c08c435c3011db4822f0d093c5e559

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\AWESOME\Documents\Visual Studio 2017\Projects\FEPX\Release\FEPX.pdb

Imports

kernel32

CreateThread
DisableThreadLibraryCalls
VirtualProtect
GetModuleHandleA
GetProcAddress
Sleep
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter

msvcp140

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?uncaught_exception@std@@YA_NXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z

ws2_32

connect
ntohs
WSAGetLastError
htons
socket
send
inet_addr
WSAStartup
ntohl
closesocket
htonl
recv

vcruntime140

__CxxFrameHandler3
memmove
__std_terminate
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__std_type_info_destroy_list
memset
_except_handler4_common
memcpy

api-ms-win-crt-runtime-l1-1-0

_cexit
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_initialize_onexit_table
_execute_onexit_table
_invalid_parameter_noinfo_noreturn
system
exit

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf_s

api-ms-win-crt-heap-l1-1-0

malloc
_callnewh
free

Exports

Exports

??0CNetworkMessage@@QAE@E@Z
??0CNetworkMessage@@QAE@XZ
??1CNetworkMessage@@QAE@XZ
??4CNetworkMessage@@QAEXABV0@@Z
??5CNetworkMessage@@QAEAAV0@AAC@Z
??5CNetworkMessage@@QAEAAV0@AAE@Z
??5CNetworkMessage@@QAEAAV0@AAF@Z
??5CNetworkMessage@@QAEAAV0@AAG@Z
??5CNetworkMessage@@QAEAAV0@AAH@Z
??5CNetworkMessage@@QAEAAV0@AAJ@Z
??5CNetworkMessage@@QAEAAV0@AAK@Z
??5CNetworkMessage@@QAEAAV0@AAM@Z
??5CNetworkMessage@@QAEAAV0@AAN@Z
??5CNetworkMessage@@QAEAAV0@AA_J@Z
??6CNetworkMessage@@QAEAAV0@ABC@Z
??6CNetworkMessage@@QAEAAV0@ABE@Z
??6CNetworkMessage@@QAEAAV0@ABM@Z
??6CNetworkMessage@@QAEAAV0@ABN@Z
??6CNetworkMessage@@QAEAAV0@F@Z
??6CNetworkMessage@@QAEAAV0@G@Z
??6CNetworkMessage@@QAEAAV0@J@Z
??6CNetworkMessage@@QAEAAV0@K@Z
??6CNetworkMessage@@QAEAAV0@_J@Z
?EndOfMessage@CNetworkMessage@@QAEHXZ
?GetBuffer@CNetworkMessage@@QAEPAXXZ
?GetType@CNetworkMessage@@QBEEXZ
?IgnoreContents@CNetworkMessage@@QAEXXZ
?Initialize@CNetworkMessage@@QAEXE@Z
?Initialize@CNetworkMessage@@QAEXXZ
?Read@CNetworkMessage@@QAEXPAXJ@Z
?Reinit@CNetworkMessage@@QAEXXZ
?Rewind@CNetworkMessage@@QAEXXZ
?SetLoginType@CNetworkMessage@@QAEXE@Z
?Write@CNetworkMessage@@QAEXPBXJ@Z
?htonll3@CNetworkMessage@@QAE_J_J@Z
?ntohll3@CNetworkMessage@@QAE_J_J@Z
?setSize@CNetworkMessage@@QAEXH@Z

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 924B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d2c08c435c3011db4822f0d093c5e559

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcp140

ws2_32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

Exports

Exports

Sections

.text Size: 11KB - Virtual size: 11KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1024B - Virtual size: 924B

.text
Size: 11KB - Virtual size: 11KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1024B - Virtual size: 924B