0d069ce2ce1b3e56f21f5a9c5c127ab51cfe87d061eeaab9a812d5a31ebd650a

Sharing

Copy URL Twitter E-mail

General

Target

0d069ce2ce1b3e56f21f5a9c5c127ab51cfe87d061eeaab9a812d5a31ebd650a
Size

1.5MB
MD5

a53e950960fd43aa2c5b333482c1f33c
SHA1

6d2399d4e951d3f961a600b1555f73d4675a90d8
SHA256

0d069ce2ce1b3e56f21f5a9c5c127ab51cfe87d061eeaab9a812d5a31ebd650a
SHA512

e409d2288d31e15aad497840f8fc7eabc6717d7fb5efcdb1ffa888310d13a49eb3b7d262ce316575263830c90ab0269a6eaf3e0143b5683d921493794705bc12
SSDEEP

24576:QA4lKmfAomLQDwwGWPWSJmmEFy+0/gGqvW0ow5gtqSmLPVtzmNHY0aM58V:Qcmfz8Q68PmmxOGqvHowO09LmFY0T8V

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d069ce2ce1b3e56f21f5a9c5c127ab51cfe87d061eeaab9a812d5a31ebd650a

Files

0d069ce2ce1b3e56f21f5a9c5c127ab51cfe87d061eeaab9a812d5a31ebd650a
.exe windows:4 windows x86 arch:x86

7ff9aacd9f78fd0b5c5c68330c25aa16

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\ysws_dev\launcher\source\bin\Release\GenPatchRuntime.pdb

Imports

kernel32

InterlockedExchangeAdd
LoadLibraryA
GetVersionExA
GetCurrentThreadId
DeleteCriticalSection
GetModuleHandleA
EnterCriticalSection
GetThreadLocale
InterlockedExchange
RaiseException
FlushInstructionCache
GetACP
CreateProcessA
LeaveCriticalSection
InitializeCriticalSection
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
IsBadCodePtr
QueryPerformanceCounter
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetProcessHeap
HeapFree
GetCurrentProcess
HeapAlloc
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetOEMCP
FlushFileBuffers
ReadFile
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
CloseHandle
CreateMutexA
GetLastError
UnhandledExceptionFilter
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
HeapSize
GetProcAddress
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
LCMapStringW
LCMapStringA
RtlUnwind
GetCPInfo
VirtualAlloc
VirtualProtect
CreateThread
SetFileTime
GetFileTime
CreateFileA
GetFileSize
GetSystemTimeAsFileTime
GetFileAttributesA
CreateDirectoryA
SetCurrentDirectoryA
RemoveDirectoryA
SetFileAttributesA
MoveFileA
GetCurrentDirectoryA
DeleteFileA
AllocConsole
Process32First
GetLogicalDrives
GetStdHandle
AttachConsole
Process32Next
GetModuleFileNameA
CreateToolhelp32Snapshot
GetDiskFreeSpaceExA
ExitProcess
SetFilePointer
WaitForSingleObject
GetTickCount
WriteFile
SetLastError
OutputDebugStringA
ReleaseMutex
GetCurrentProcessId
ExpandEnvironmentStringsA
InitializeCriticalSectionAndSpinCount
GetExitCodeProcess
TerminateProcess
GetCurrentThread
IsDebuggerPresent
FileTimeToDosDateTime
GlobalMemoryStatus
VirtualQuery
lstrcpynA
SetUnhandledExceptionFilter
IsBadStringPtrA
Module32First
GetLocalTime
GetSystemInfo
Module32Next
FileTimeToLocalFileTime
GetVersion
LocalFree
FindResourceA
lstrlenA
FreeLibrary
LoadResource
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
SizeofResource
IsDBCSLeadByte
MultiByteToWideChar
lstrlenW
lstrcmpiA
LoadLibraryExA
IsBadReadPtr
HeapReAlloc
GetStartupInfoA
GetCommandLineA
SetStdHandle
GetFileType
GetTimeZoneInformation
ExitThread

user32

SystemParametersInfoA
SetWindowPos
MapWindowPoints
GetSystemMetrics
EnableWindow
CallWindowProcA
SetWindowTextA
LoadImageA
GetDlgItem
EndDialog
CreateWindowExA
GetWindowLongA
UnregisterClassA
LoadCursorA
GetWindow
IsWindow
PostMessageA
DefWindowProcA
GetActiveWindow
DialogBoxParamA
GetWindowRect
RegisterClassExA
GetClassInfoExA
GetParent
LoadIconA
wsprintfA
GetClientRect
SendMessageA
GetWindowTextA
CharNextA
SetWindowLongA
MessageBoxA

gdi32

GetStockObject
GetObjectA
DeleteObject
CreateFontIndirectA

shell32

ShellExecuteExA
SHGetPathFromIDListA
SHBrowseForFolderA

oleaut32

VarUI4FromStr

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

shlwapi

wnsprintfA

dbghelp

SymSetOptions
SymInitialize
SymFromAddr
SymGetTypeInfo
SymGetLineFromAddr
SymCleanup
SymFunctionTableAccess
SymGetModuleBase
MiniDumpWriteDump
StackWalk
SymEnumSymbols
UnDecorateSymbolName
SymSetContext

advapi32

RegCloseKey
RegQueryValueExA
RegEnumKeyExA
GetUserNameA
RegDeleteKeyA
RegDeleteValueA
RegQueryInfoKeyA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA

ole32

CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance

Sections

.text
Size: 304KB - Virtual size: 300KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7ff9aacd9f78fd0b5c5c68330c25aa16

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

oleaut32

version

shlwapi

dbghelp

advapi32

ole32

Sections

.text Size: 304KB - Virtual size: 300KB

.rdata Size: 56KB - Virtual size: 55KB

.data Size: 12KB - Virtual size: 18KB

.rsrc Size: 20KB - Virtual size: 17KB

.text
Size: 304KB - Virtual size: 300KB

.rdata
Size: 56KB - Virtual size: 55KB

.data
Size: 12KB - Virtual size: 18KB

.rsrc
Size: 20KB - Virtual size: 17KB