7d735e25aaaf1e7db3b09822a7c8c1de571cd1c0d136d45b1a62e12e2296c457

Sharing

Copy URL Twitter E-mail

General

Target

7d735e25aaaf1e7db3b09822a7c8c1de571cd1c0d136d45b1a62e12e2296c457
Size

530KB
MD5

fcf1e15f7fdfb4b1183b82531fdd1c59
SHA1

bbb2fdaed254215f6acd2e540ab5bf39c54b6095
SHA256

7d735e25aaaf1e7db3b09822a7c8c1de571cd1c0d136d45b1a62e12e2296c457
SHA512

3f92edd9a296b1c394861b37b78aad1faafa0f2c8a1f5c75cd2a31273e371f8a0b0edc42c67da3b4011ca9a9812579b61a54467466bac9f23bd314ef4e3eadf5
SSDEEP

12288:nGjnQByfhRfln32KknkVDgSPSWq6DdMwikfkxDLXTDcTUQBj24g7:0fhRfp2JnPRWq6DdMwi2kNTw7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7d735e25aaaf1e7db3b09822a7c8c1de571cd1c0d136d45b1a62e12e2296c457

Files

7d735e25aaaf1e7db3b09822a7c8c1de571cd1c0d136d45b1a62e12e2296c457
.dll windows:5 windows x86 arch:x86

4c6f3a533c8564816d486c151c6bbb6f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\builds\build-sourcemod-msvc12\windows-1.12\OUTPUT\core\sourcemod.2.dods\windows-x86\sourcemod.2.dods.pdb

Imports

kernel32

GetLastError
FreeLibrary
GetProcAddress
LoadLibraryA
FormatMessageA
GetFileAttributesA
SetEndOfFile
ReadConsoleW
ReadFile
HeapReAlloc
HeapSize
CreateFileW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
GetStringTypeW
SetFilePointerEx
GetFileSizeEx
CreateDirectoryW
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetCurrentThreadId
MultiByteToWideChar
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
CloseHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
RaiseException
InterlockedFlushSList
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
GetFileType
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
ExitProcess
HeapFree
HeapAlloc
LCMapStringW
DecodePointer
WriteFile
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP

tier0

_AssertValidWritePtr
AssertValidStringPtr
g_VProfCurrentProfile
?OutputReport@CVProfile@@QAEXHPBDH@Z
?Pause@CVProfile@@QAEXXZ
?ExitScope@CVProfile@@QAEXXZ
?EnterScope@CVProfile@@QAEXPBDH0_NH@Z
?Resume@CVProfNode@@QAEXXZ
g_pMemAlloc
Warning
GetSpewOutputFunc
SpewOutputFunc
MemFreeScratch
_AssertValidReadPtr
MemAllocScratch
DevMsg
?DevMsg@@YAXPBDZZ

vstdlib

RandomFloat
RandomInt
KeyValuesSystem
RandomSeed

Exports

Exports

CreateInterface
cvar
g_pCVar

Sections

.text
Size: 378KB - Virtual size: 377KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4c6f3a533c8564816d486c151c6bbb6f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

tier0

vstdlib

Exports

Exports

Sections

.text Size: 378KB - Virtual size: 377KB

.rdata Size: 101KB - Virtual size: 101KB

.data Size: 24KB - Virtual size: 84KB

.rsrc Size: 1024B - Virtual size: 880B

.reloc Size: 25KB - Virtual size: 24KB

.text
Size: 378KB - Virtual size: 377KB

.rdata
Size: 101KB - Virtual size: 101KB

.data
Size: 24KB - Virtual size: 84KB

.rsrc
Size: 1024B - Virtual size: 880B

.reloc
Size: 25KB - Virtual size: 24KB