e0ec0b76f292572d902bde076810ab51b4067ce92b05b46f78202058ae679c60

Sharing

Copy URL Twitter E-mail

General

Target

e0ec0b76f292572d902bde076810ab51b4067ce92b05b46f78202058ae679c60
Size

6.1MB
MD5

becff6e7b2588bb40b96aca90db10605
SHA1

2c4fe9e6226625f0e3d27457bfccb07ac1453499
SHA256

e0ec0b76f292572d902bde076810ab51b4067ce92b05b46f78202058ae679c60
SHA512

67cdb915180397c5811a1affea246b9d29c9c74f8bef99f84d66487bdbf84a200d3d1037775bc59dedacc817cff3a854b0065fbdd7e37e871e8738246b859e54
SSDEEP

49152:67YTeH1nSnnjuVEyZ/qG4Lhtew8PvR07xNayz2/7P9WvJ4+Ugp1Lz1enKddFF8:+FwayzTr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e0ec0b76f292572d902bde076810ab51b4067ce92b05b46f78202058ae679c60

Files

e0ec0b76f292572d902bde076810ab51b4067ce92b05b46f78202058ae679c60
.dll windows:6 windows x64 arch:x64

2326dca7de1acd92359fbc94d41bddfa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\raven\shield-development\build\bin\x64\Debug\d3d11.pdb

Imports

kernel32

GetCurrentProcessId
AllocConsole
AttachConsole
ReadConsoleInputA
GetConsoleCursorInfo
SetConsoleCursorInfo
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
SetConsoleTitleA
GetConsoleWindow
OutputDebugStringA
GetTickCount
GetSystemDirectoryA
DecodePointer
GetLastError
SetLastError
InitializeCriticalSectionEx
DeleteCriticalSection
MultiByteToWideChar
GetCurrentThreadId
SetUnhandledExceptionFilter
RtlCaptureStackBackTrace
RtlUnwind
CreateEventA
GetThreadContext
HeapDestroy
HeapCreate
InitializeCriticalSection
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetProcAddress
CreateThread
SetEvent
SetEndOfFile
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetOEMCP
GetACP
IsValidCodePage
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
GetStdHandle
SetThreadContext
TerminateProcess
GetCurrentProcess
IsBadReadPtr
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetTimeZoneInformation
HeapQueryInformation
HeapReAlloc
SetConsoleCtrlHandler
WriteFile
ExitProcess
WriteConsoleW
GetFileType
GetCommandLineA
GetCurrentDirectoryA
CloseHandle
CreateProcessA
VirtualProtect
FreeLibrary
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleExA
LoadResource
LockResource
SizeofResource
LoadLibraryA
FindResourceA
FlushInstructionCache
VirtualAlloc
VirtualFree
GlobalUnlock
GlobalLock
GetCurrentThread
OpenThread
SuspendThread
ResumeThread
GetThreadId
CreateToolhelp32Snapshot
Thread32First
Thread32Next
CreateFileA
FlushFileBuffers
ReadFile
SetFilePointer
GetTempPathA
GetTempFileNameA
DeleteFileA
MoveFileA
VirtualQuery
GetSystemFirmwareTable
IsDebuggerPresent
OutputDebugStringW
RaiseException
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
InitOnceBeginInitialize
InitOnceComplete
WideCharToMultiByte
GetCPInfoExW
WaitForSingleObjectEx
Sleep
SwitchToThread
GetExitCodeThread
GetNativeSystemInfo
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
TryAcquireSRWLockShared
LocalFree
FormatMessageA
GetLocaleInfoEx
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetDiskFreeSpaceExW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFullPathNameW
SetFileAttributesW
SetFileInformationByHandle
SetFileTime
GetTempPathW
AreFileApisANSI
DeviceIoControl
GetModuleHandleW
CreateDirectoryExW
CopyFileW
MoveFileExW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
InitOnceExecuteOnce
LoadLibraryExW
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetSystemTimeAsFileTime
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
EncodePointer
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
LCMapStringEx
CompareStringEx
GetCPInfo
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
HeapAlloc
HeapFree
GetProcessHeap
RtlPcToFileHeader
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
HeapSize
HeapValidate
GetSystemInfo
ExitThread
FreeLibraryAndExitThread
CreateMutexExA

user32

MessageBoxA
ShowCursor
TranslateMessage
DispatchMessageA
PeekMessageA
ShowWindow
GetWindowTextA
GetAsyncKeyState
DispatchMessageW
PeekMessageW
SendMessageA
DefWindowProcA
GetClipboardData
CloseClipboard
GetWindowTextW
MsgWaitForMultipleObjects
OpenClipboard
LoadIconA
LoadCursorA
AdjustWindowRect
GetWindowRect
UpdateWindow
GetSystemMetrics
SetWindowPos
DestroyWindow
IsWindow
CreateWindowExA
UnregisterClassA
RegisterClassA
PostQuitMessage

gdi32

CreateBitmap
DeleteObject

advapi32

CryptAcquireContextW
RegOpenKeyExW
RegCloseKey
GetUserNameA
RegQueryValueExW
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom

shell32

ShellExecuteA

ws2_32

__WSAFDIsSet
closesocket
connect
ioctlsocket
getpeername
getsockname
recv
recvfrom
select
send
sendto
gethostbyname
WSASetLastError
getaddrinfo
freeaddrinfo

dbghelp

MiniDumpWriteDump

Exports

Exports

D3D11CreateDevice

Sections

.text
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 96KB - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 293KB - Virtual size: 293KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 248KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2326dca7de1acd92359fbc94d41bddfa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ws2_32

dbghelp

Exports

Exports

Sections

.text Size: 4.0MB - Virtual size: 4.0MB

.rdata Size: 1.5MB - Virtual size: 1.5MB

.data Size: 96KB - Virtual size: 155KB

.pdata Size: 293KB - Virtual size: 293KB

.msvcjmc Size: 22KB - Virtual size: 21KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 248KB - Virtual size: 248KB

.reloc Size: 19KB - Virtual size: 19KB

.text
Size: 4.0MB - Virtual size: 4.0MB

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 96KB - Virtual size: 155KB

.pdata
Size: 293KB - Virtual size: 293KB

.msvcjmc
Size: 22KB - Virtual size: 21KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 248KB - Virtual size: 248KB

.reloc
Size: 19KB - Virtual size: 19KB