AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
hx_cffi
Static task
static1
1 signatures
General
-
Target
VS A.G.O.T.I.exe
-
Size
15.8MB
-
MD5
8b0fd0a61618c20275b3b4f5b3e634bd
-
SHA1
b76c03f5b7500b42e7aab285f734df4565994b51
-
SHA256
e36b874102499ab0d176d28578a2f42d1da68cfdaf1399f4d9cc2d8300d43fa0
-
SHA512
1d5f87e12d26cdc5c9b2521cd3537f03ff0add6cd4439f2340dc3e82717c9ccc42d9011edad3026b4e7f02feaa043eb9b4a5413c75892efd3acb9c31ee5e416b
-
SSDEEP
196608:PxETE/LClM/yKxLhanQtr/ULlZVb2oA2oKi1i:PxETE/L8M/yKxLhanQtr/ULlnj
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VS A.G.O.T.I.exe
Files
-
VS A.G.O.T.I.exe.exe windows:6 windows x64 arch:x64
113b9046a8e863f497ff984e3733ad06
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
user32
MessageBoxA
ws2_32
getaddrinfo
WSAGetLastError
WSAStartup
gethostbyname
socket
shutdown
setsockopt
send
freeaddrinfo
inet_ntoa
inet_addr
htons
ioctlsocket
connect
closesocket
recv
advapi32
RegOpenKeyExW
CryptReleaseContext
CryptGenRandom
RegCloseKey
RegSetKeyValueW
RegQueryValueExW
CryptAcquireContextA
RegCreateKeyExW
crypt32
CertEnumCertificatesInStore
CertOpenSystemStoreA
CertCloseStore
kernel32
FindFirstFileExA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
GetFileAttributesExW
SetEnvironmentVariableW
SetFilePointerEx
GetConsoleCP
FlushFileBuffers
ReadConsoleW
GetConsoleMode
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
FindNextFileA
GetCommandLineW
GetProcessHeap
HeapSize
SetEndOfFile
SetEnvironmentVariableA
WaitForSingleObjectEx
TlsGetValue
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTime
SystemTimeToFileTime
RtlCaptureContext
TlsSetValue
TlsAlloc
CloseHandle
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
CreateThread
GetCurrentThreadId
FreeLibrary
GetProcAddress
LoadLibraryW
GetCommandLineA
LoadLibraryA
ReadFile
WriteFile
DuplicateHandle
CreatePipe
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetCurrentProcessId
GetTickCount
FormatMessageA
SetCurrentDirectoryW
GetCurrentDirectoryW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetFullPathNameW
Sleep
GetModuleFileNameW
GetLastError
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
PeekNamedPipe
WaitNamedPipeW
RtlUnwindEx
RaiseException
SetLastError
VirtualFree
VirtualQuery
GetModuleHandleA
LoadLibraryExA
GetModuleFileNameA
GetModuleHandleExA
VirtualAlloc
VirtualProtect
RtlUnwind
SwitchToThread
GetExitCodeThread
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
OutputDebugStringW
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
LoadLibraryExW
GetVersionExW
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
IsValidLocale
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetStdHandle
CreateDirectoryW
DeleteFileW
MoveFileExW
GetACP
GetStdHandle
WriteConsoleW
ExitThread
CreateProcessA
GetTempPathW
HeapFree
HeapAlloc
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
Exports
Exports
Sections
.text Size: 11.1MB - Virtual size: 11.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.1MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 464KB - Virtual size: 464KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 383KB - Virtual size: 383KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 266KB - Virtual size: 266KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ