670a060fa4b62817a84bb665134f314be0f7958de3a2a9643b7e542538dd9379[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

670a060fa4b62817a84bb665134f314be0f7958de3a2a9643b7e542538dd9379.exe
Size

1.1MB
MD5

4c477b68fc5b544ae44e9f8633989220
SHA1

3bbb86a98e50c0b527948776e0594f62d911a70f
SHA256

670a060fa4b62817a84bb665134f314be0f7958de3a2a9643b7e542538dd9379
SHA512

00a8b7fbf4479316dedb2316a0a6b95de1f2d65de0012b57fbafdcc8ecf6849a3a51d1e6b15bcb5cca4f81dd889805bf7e3db25190a34d8877c20738ebb4c53a
SSDEEP

12288:Lyxlf2A6ABXT+5TNgPshJkzj2nXLsjTuvRiF4AhKBa3ue:mJBXT+rUs4zjEXoqRiF4AIQue

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
670a060fa4b62817a84bb665134f314be0f7958de3a2a9643b7e542538dd9379.exe

Files

670a060fa4b62817a84bb665134f314be0f7958de3a2a9643b7e542538dd9379.exe
.dll windows:6 windows x86 arch:x86

b8bcce387d8715cd66617cec6f06a990

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

g:\rpcs\release\jupiter-p2\rpcs95\drivers\jp2\src\code32\gr2k\lib\i386\rpcsgr.pdb

Imports

msvcrt

_ltoa
_wtol
_stricmp
memcmp
strncpy
strcmp
sprintf
wcsncpy
wcsrchr
_wcsicmp
_wtoi
_strnicmp
_wcsnicmp
wcslen
_strcmpi
strncmp
atoi
wcsstr
wcsncmp
_itoa
memcpy
_adjust_fdiv
_amsg_exit
_initterm
free
malloc
_XcptFilter
wcschr
strcat
strcpy
strlen
wcscat
wcscmp
_itow
wcscpy
memset
swprintf

kernel32

GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
MulDiv
LoadLibraryA
GetEnvironmentVariableW
SetEnvironmentVariableW
IsDBCSLeadByteEx
GetFileSize
CreateFileMappingW
MapViewOfFile
GetPrivateProfileIntA
GetPrivateProfileStringA
GlobalReAlloc
IsDBCSLeadByte
CompareFileTime
UnmapViewOfFile
SetFilePointer
VerSetConditionMask
VerifyVersionInfoW
GetVersionExW
ReleaseMutex
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CreateMutexW
GetACP
RtlUnwind
InterlockedCompareExchange
Sleep
InterlockedExchange
GetVersion
GetProcAddress
SetLastError
GlobalAlloc
GlobalFree
LocalAlloc
LocalFree
LoadLibraryW
GetCurrentThread
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
WriteFile
ReadFile
GetLastError
GetWindowsDirectoryW
GetSystemDirectoryW
WritePrivateProfileSectionW
GetPrivateProfileSectionW
GetLocaleInfoW
GetUserDefaultLCID
CloseHandle
GetFileTime
CreateFileW
WaitForSingleObject
DeleteFileW
FindClose
FindFirstFileW

mscms

OpenColorProfileW
CloseColorProfile
DeleteColorTransform
CreateColorTransformW

winspool.drv

GetJobW
SetPrinterDataW
GetPrinterDataW
GetPrinterDriverW
GetPrinterW

gdi32

EngDeletePalette
EngCreateBitmap
EngMarkBandingSurface
EngCreateDeviceSurface
EngAssociateSurface
EngDeleteSurface
EngQueryLocalTime
EngCreatePalette
EngGetCurrentCodePage
XFORMOBJ_iGetXform
FONTOBJ_pxoGetXform
EngTextOut
FONTOBJ_pifi
STROBJ_bEnum
STROBJ_vEnumStart
EngUnicodeToMultiByteN
PATHOBJ_vGetBounds
FONTOBJ_cGetGlyphs
XFORMOBJ_bApplyXform
EngFindResource
EngUnlockSurface
EngLockSurface
EngStretchBlt
EngDeletePath
CLIPOBJ_ppoGetPath
EngBitBlt
EngEraseSurface
BRUSHOBJ_pvAllocRbrush
EngStrokePath
EngFillPath
EngStrokeAndFillPath
PATHOBJ_bEnum
PATHOBJ_vEnumStart
BRUSHOBJ_pvGetRbrush
EngStretchBltROP
EngCopyBits
CLIPOBJ_bEnum
TranslateCharsetInfo
CLIPOBJ_cEnumStart

user32

LoadStringW

advapi32

RegOpenKeyW
OpenThreadToken
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
FreeSid
GetLengthSid
AllocateAndInitializeSid
SetSecurityDescriptorOwner
GetUserNameW
RevertToSelf
AccessCheck
IsValidSecurityDescriptor
SetSecurityDescriptorGroup
AddAccessAllowedAce
ImpersonateSelf
RegCloseKey
RegQueryValueExW
OpenProcessToken
RegEnumKeyExA
RegQueryInfoKeyA
RegOpenKeyExA
RegQueryValueExA

ntdll

RtlUnicodeToMultiByteN
RtlMultiByteToUnicodeN

Exports

Exports

DllMain
DrvDisableDriver
DrvEnableDriver
DrvQueryDriverInfo

Sections

.text
Size: 968KB - Virtual size: 967KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b8bcce387d8715cd66617cec6f06a990

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

mscms

winspool.drv

gdi32

user32

advapi32

ntdll

Exports

Exports

Sections

.text Size: 968KB - Virtual size: 967KB

.data Size: 24KB - Virtual size: 25KB

.rsrc Size: 74KB - Virtual size: 74KB

.reloc Size: 34KB - Virtual size: 34KB

.text
Size: 968KB - Virtual size: 967KB

.data
Size: 24KB - Virtual size: 25KB

.rsrc
Size: 74KB - Virtual size: 74KB

.reloc
Size: 34KB - Virtual size: 34KB