6f25cf92d8aec6058f46dceb6da8f1c12787c785be56bca279f80bad63ae35e2

Sharing

Copy URL Twitter E-mail

General

Target

6f25cf92d8aec6058f46dceb6da8f1c12787c785be56bca279f80bad63ae35e2
Size

711KB
MD5

6cbfc867b646de4887b6cfc131a96467
SHA1

f219c07b631e24128ecbfc304360aa17155a9a89
SHA256

6f25cf92d8aec6058f46dceb6da8f1c12787c785be56bca279f80bad63ae35e2
SHA512

4a1f5d8a9477c639ddbbe090e9b94a736abe82ebf20b45a82d91d877c2e6d94137d8be98d2043f563315e4b2490c0bd39942777043887833998e71c5e657ed9d
SSDEEP

12288:kWuD8tBznOVqoNq+Otn7RKKufxls5P0mW5Od1Dr5Od1Dj1:kWuDANY/Ot7Uyryj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6f25cf92d8aec6058f46dceb6da8f1c12787c785be56bca279f80bad63ae35e2

Files

6f25cf92d8aec6058f46dceb6da8f1c12787c785be56bca279f80bad63ae35e2
.exe windows:6 windows x86 arch:x86

0bbcee04b3b4d5f8a95801302fb15858

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Code\thunder11\xlgame\bin\ProductRelease\XLGameUninstall.pdb

Imports

kernel32

WriteFile
TerminateProcess
RemoveDirectoryW
GetModuleFileNameW
K32GetModuleFileNameExW
GetTempPathW
FindClose
GetCurrentThreadId
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
OutputDebugStringW
DeleteFileW
Process32FirstW
LoadLibraryW
GetProcAddress
LocalFree
GetCurrentProcess
CopyFileW
MoveFileW
InitializeCriticalSection
CreateMutexW
OpenMutexW
GetFileType
GetStdHandle
GetModuleHandleExW
WriteConsoleW
GetConsoleCP
FlushFileBuffers
FindNextFileW
GetCommandLineW
SetLastError
FindFirstFileW
GetSystemTime
SystemTimeToTzSpecificLocalTime
GetFileSize
CloseHandle
Sleep
MultiByteToWideChar
CreateFileW
LeaveCriticalSection
EnterCriticalSection
ReadFile
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
HeapFree
RaiseException
HeapReAlloc
GetLastError
HeapSize
ExitProcess
LoadLibraryExW
SetFilePointerEx
SetStdHandle
FreeEnvironmentStringsW
FreeLibrary
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
InitializeCriticalSectionEx
GetModuleHandleW
GetACP
IsValidCodePage
FindFirstFileExW
GetConsoleMode
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
lstrcatA
GetFileAttributesA
lstrcpyA
WritePrivateProfileStringA
CreateDirectoryA
GetPrivateProfileStringA
SetPriorityClass
DeviceIoControl
GetVolumeInformationA
CreateFileA
GetVersionExA
GetFileSizeEx
GetFileAttributesW
WideCharToMultiByte
EncodePointer
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
IsDebuggerPresent
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
RtlUnwind

advapi32

UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableLevel
RegisterTraceGuidsW
GetAclInformation
GetAce
EqualSid
GetSidSubAuthority
GetSidLengthRequired
SetNamedSecurityInfoW
CopySid
GetNamedSecurityInfoW
InitializeSid
IsValidSid
AddAce
InitializeAcl
GetLengthSid
TraceEvent

shell32

SHGetSpecialFolderPathA
SHCreateDirectoryExW
CommandLineToArgvW
ShellExecuteExW

ole32

CoUninitialize
CoInitialize

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

iphlpapi

GetAdaptersInfo

shlwapi

PathCombineW
PathFileExistsW
PathAppendW
PathRemoveFileSpecW
StrCmpIW
PathFindFileNameW

Sections

.text
Size: 226KB - Virtual size: 225KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 397KB - Virtual size: 400KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0bbcee04b3b4d5f8a95801302fb15858

Headers

File Characteristics

PDB Paths

Imports

kernel32

advapi32

shell32

ole32

version

iphlpapi

shlwapi

Sections

.text Size: 226KB - Virtual size: 225KB

.rdata Size: 72KB - Virtual size: 71KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 397KB - Virtual size: 400KB

.reloc Size: 11KB - Virtual size: 10KB

.text
Size: 226KB - Virtual size: 225KB

.rdata
Size: 72KB - Virtual size: 71KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 397KB - Virtual size: 400KB

.reloc
Size: 11KB - Virtual size: 10KB