scrcpy[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

scrcpy.exe
Size

666KB
MD5

ce4dd59809e9ecfbcbb47218678d204f
SHA1

7161e0a54c02e7f33b11de848e30847c668557b3
SHA256

2c37b44929c259b6e6b027c6bc6b23279536538738ced72f98fa805b8e5c3629
SHA512

8381654d9e349bd9d3afe91258d24cdf694baf6f1c7a65b79d40ab603d5f91d95d9198a8077ae7c7c43c1e6aaa60b5810d3e506795e34fd662380e223a5c6077
SSDEEP

12288:Tqalh9ol/G7QYmz1tEggXvUlwpg9TBzFm+7p4NI4:THh9oyQYiPEggfU+O37p424

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
scrcpy.exe

Files

scrcpy.exe
.exe windows:4 windows x64 arch:x64

0c84cd9a90c849a006b8f4300082f285

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

sdl2

SDL_AddEventWatch
SDL_CloseAudioDevice
SDL_CondBroadcast
SDL_CondSignal
SDL_CondWait
SDL_CondWaitTimeout
SDL_CreateCond
SDL_CreateMutex
SDL_CreateRGBSurfaceWithFormatFrom
SDL_CreateRenderer
SDL_CreateTexture
SDL_CreateTextureFromSurface
SDL_CreateThread
SDL_CreateWindow
SDL_DestroyCond
SDL_DestroyMutex
SDL_DestroyRenderer
SDL_DestroyTexture
SDL_DestroyWindow
SDL_DisableScreenSaver
SDL_EnableScreenSaver
SDL_FreeSurface
SDL_GL_BindTexture
SDL_GL_GetDrawableSize
SDL_GL_GetProcAddress
SDL_GL_UnbindTexture
SDL_GetClipboardText
SDL_GetDisplayUsableBounds
SDL_GetError
SDL_GetModState
SDL_GetMouseState
SDL_GetRelativeMouseMode
SDL_GetRendererInfo
SDL_GetVersion
SDL_GetWindowPosition
SDL_GetWindowSize
SDL_HideWindow
SDL_Init
SDL_LockAudioDevice
SDL_LockMutex
SDL_LogDebug
SDL_LogError
SDL_LogGetPriority
SDL_LogInfo
SDL_LogMessageV
SDL_LogSetOutputFunction
SDL_LogSetPriority
SDL_LogVerbose
SDL_LogWarn
SDL_OpenAudioDevice
SDL_PauseAudioDevice
SDL_PushEvent
SDL_Quit
SDL_RenderClear
SDL_RenderCopy
SDL_RenderCopyEx
SDL_RenderPresent
SDL_RenderSetLogicalSize
SDL_RestoreWindow
SDL_SetClipboardText
SDL_SetHint
SDL_SetMainReady
SDL_SetPaletteColors
SDL_SetRelativeMouseMode
SDL_SetThreadPriority
SDL_SetWindowFullscreen
SDL_SetWindowIcon
SDL_SetWindowPosition
SDL_SetWindowSize
SDL_ShowSimpleMessageBox
SDL_ShowWindow
SDL_ThreadID
SDL_UnlockAudioDevice
SDL_UnlockMutex
SDL_UpdateYUVTexture
SDL_WaitEvent
SDL_WaitThread
SDL_free
SDL_iconv_string
SDL_memcpy
SDL_strlen
SDL_wcslen

avcodec-60

av_grow_packet
av_new_packet
av_packet_alloc
av_packet_free
av_packet_ref
av_packet_rescale_ts
av_packet_side_data_new
av_packet_unref
avcodec_alloc_context3
avcodec_close
avcodec_find_decoder
avcodec_free_context
avcodec_open2
avcodec_parameters_from_context
avcodec_parameters_to_context
avcodec_receive_frame
avcodec_send_packet
avcodec_version

avformat-60

av_find_best_stream
av_interleaved_write_frame
av_muxer_iterate
av_read_frame
av_write_trailer
avformat_alloc_context
avformat_close_input
avformat_find_stream_info
avformat_free_context
avformat_new_stream
avformat_open_input
avformat_version
avformat_write_header
avio_close
avio_open

avutil-58

av_dict_set
av_display_rotation_set
av_frame_alloc
av_frame_free
av_frame_move_ref
av_frame_ref
av_frame_unref
av_get_bits_per_pixel
av_get_bytes_per_sample
av_log_set_callback
av_malloc
av_opt_set_chlayout
av_opt_set_int
av_opt_set_sample_fmt
av_pix_fmt_desc_get
avutil_version

swresample-4

swr_alloc
swr_convert
swr_free
swr_get_delay
swr_init
swr_set_compensation

libusb-1.0

libusb_close
libusb_control_transfer
libusb_exit
libusb_free_device_list
libusb_get_device
libusb_get_device_descriptor
libusb_get_device_list
libusb_get_string_descriptor_ascii
libusb_get_version
libusb_handle_events
libusb_has_capability
libusb_hotplug_deregister_callback
libusb_hotplug_register_callback
libusb_init
libusb_open
libusb_ref_device
libusb_strerror
libusb_unref_device

kernel32

CloseHandle
CreatePipe
CreateProcessW
DeleteCriticalSection
DeleteProcThreadAttributeList
EnterCriticalSection
FormatMessageA
GetCommandLineW
GetConsoleScreenBufferInfo
GetEnvironmentVariableW
GetExitCodeProcess
GetLastError
GetModuleFileNameW
GetModuleHandleW
GetProcessHeap
GetStartupInfoA
GetStdHandle
HeapAlloc
HeapFree
InitializeCriticalSection
InitializeProcThreadAttributeList
IsDBCSLeadByteEx
LeaveCriticalSection
LocalFree
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
SetConsoleCtrlHandler
SetHandleInformation
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UpdateProcThreadAttribute
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
__C_specific_handler

msvcrt

___lc_codepage_func
___mb_cur_max_func
__argv
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_fmode
_initterm
_ismbblead
_lock
_onexit
_unlock
_wgetenv
_wstat64
abort
calloc
exit
fprintf
fputc
free
fwrite
getc
getchar
getenv
isalpha
isspace
isxdigit
localeconv
malloc
memcpy
memmove
memset
perror
realloc
setbuf
signal
strchr
strcmp
strcspn
strerror
strlen
strncmp
strrchr
strspn
strtol
strtoul
tolower
ungetc
vfprintf
wcslen
_strtoui64
_strtoi64
_strdup
_isatty

shell32

CommandLineToArgvW

ws2_32

WSACleanup
WSAGetLastError
WSAStartup
accept
bind
closesocket
connect
htonl
htons
inet_pton
listen
ntohl
recv
send
setsockopt
socket

Sections

.text
Size: 169KB - Virtual size: 169KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 464B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 517KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 119KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/106
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/122
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/138
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0c84cd9a90c849a006b8f4300082f285

Headers

DLL Characteristics

File Characteristics

Imports

sdl2

avcodec-60

avformat-60

avutil-58

swresample-4

libusb-1.0

kernel32

msvcrt

shell32

ws2_32

Sections

.text Size: 169KB - Virtual size: 169KB

.data Size: 512B - Virtual size: 464B

.rdata Size: 52KB - Virtual size: 52KB

.pdata Size: 3KB - Virtual size: 3KB

.xdata Size: 3KB - Virtual size: 3KB

.bss Size: - Virtual size: 517KB

.idata Size: 11KB - Virtual size: 10KB

.CRT Size: 512B - Virtual size: 96B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 10KB - Virtual size: 10KB

.reloc Size: 1KB - Virtual size: 1KB

/4 Size: 2KB - Virtual size: 2KB

/19 Size: 119KB - Virtual size: 119KB

/31 Size: 20KB - Virtual size: 20KB

/45 Size: 55KB - Virtual size: 54KB

/57 Size: 13KB - Virtual size: 12KB

/70 Size: 1KB - Virtual size: 1KB

/81 Size: 1KB - Virtual size: 1KB

/92 Size: 512B - Virtual size: 96B

/106 Size: 8KB - Virtual size: 7KB

/122 Size: 71KB - Virtual size: 70KB

/138 Size: 3KB - Virtual size: 2KB

.text
Size: 169KB - Virtual size: 169KB

.data
Size: 512B - Virtual size: 464B

.rdata
Size: 52KB - Virtual size: 52KB

.pdata
Size: 3KB - Virtual size: 3KB

.xdata
Size: 3KB - Virtual size: 3KB

.bss
Size: - Virtual size: 517KB

.idata
Size: 11KB - Virtual size: 10KB

.CRT
Size: 512B - Virtual size: 96B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 10KB - Virtual size: 10KB

.reloc
Size: 1KB - Virtual size: 1KB

/4
Size: 2KB - Virtual size: 2KB

/19
Size: 119KB - Virtual size: 119KB

/31
Size: 20KB - Virtual size: 20KB

/45
Size: 55KB - Virtual size: 54KB

/57
Size: 13KB - Virtual size: 12KB

/70
Size: 1KB - Virtual size: 1KB

/81
Size: 1KB - Virtual size: 1KB

/92
Size: 512B - Virtual size: 96B

/106
Size: 8KB - Virtual size: 7KB

/122
Size: 71KB - Virtual size: 70KB

/138
Size: 3KB - Virtual size: 2KB