521ffb60877ce657c048d87a4e979329a0a204245dad4c9b360391ebd03308df

Sharing

Copy URL Twitter E-mail

General

Target

521ffb60877ce657c048d87a4e979329a0a204245dad4c9b360391ebd03308df
Size

1.1MB
MD5

8710731746fba00be4f1ce93c3ee9bc1
SHA1

a5d187fdefd4666f85b081a41e15a675eacd4eea
SHA256

521ffb60877ce657c048d87a4e979329a0a204245dad4c9b360391ebd03308df
SHA512

1cdb46d8ca11e0d3acd079034b3f8db116a56d6dac216a60b44a2cb9505015f224b6f591f08c497946807e65e0d01bfd2b4fc5ecbe1d3eb02fc89423206781dc
SSDEEP

24576:/023dYH4zRuKqfaB5NmNPXWGERPWxNs298r3OCDIjG3gE9ow+8xA+:/0xs41faB5wNPAR+ft983Dl3gEe8xA+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
521ffb60877ce657c048d87a4e979329a0a204245dad4c9b360391ebd03308df

Files

521ffb60877ce657c048d87a4e979329a0a204245dad4c9b360391ebd03308df
.exe windows:6 windows x64 arch:x64

5f7fc48274cb7ae0575cae60c0c0a8dc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\jenkins\workspace\ReleaseBuild~ComboChip\SRC\BTDevManager_Merge\vs2017_BTDevManager\BTDevManager\bin\x64\Win10 Release\RtkBtManServ.pdb

Imports

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetErrorMode
SetLastError
GetLastError
RaiseException
UnhandledExceptionFilter

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapDestroy
HeapFree
HeapSize
GetProcessHeap
HeapAlloc

api-ms-win-core-synch-l1-1-0

CreateEventW
InitializeCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
TryEnterCriticalSection
InitializeCriticalSectionEx
CreateMutexW
InitializeSRWLock
DeleteCriticalSection
ReleaseMutex
ResetEvent
SetEvent
LeaveCriticalSection

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce
WakeAllConditionVariable
InitializeConditionVariable
SleepConditionVariableCS

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-processthreads-l1-1-0

ExitProcess
ExitThread
TerminateProcess
CreateThread
OpenProcessToken
GetCurrentThreadId
GetCurrentProcessId
GetCurrentThread
GetStartupInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentProcess
ResumeThread

api-ms-win-core-libraryloader-l1-2-0

FreeLibraryAndExitThread
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetModuleFileNameW
SizeofResource
LoadResource
LoadLibraryExW
LockResource
FreeLibrary
FindResourceExW

api-ms-win-core-libraryloader-l1-2-1

FindResourceW
LoadLibraryW

api-ms-win-security-base-l1-1-0

InitializeSecurityDescriptor
AdjustTokenPrivileges
SetSecurityDescriptorDacl

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegEnumValueW
RegQueryInfoKeyW
RegCloseKey

api-ms-win-devices-config-l1-1-1

CM_Get_DevNode_Status
CM_Register_Notification
CM_Get_Device_Interface_ListW
CM_Unregister_Notification
CM_Get_Device_ID_List_SizeW
CM_Get_Device_ID_ListW
CM_Enable_DevNode
CM_Disable_DevNode
CM_MapCrToWin32Err
CM_Get_Device_Interface_PropertyW
CM_Get_Device_Interface_List_SizeW
CM_Get_DevNode_PropertyW
CM_Locate_DevNodeW

api-ms-win-core-file-l1-1-0

DeleteFileW
GetFileSize
SetFilePointerEx
FlushFileBuffers
WriteFile
CreateFileW
CreateDirectoryW
FindFirstFileExW
ReadFile
SetEndOfFile
GetFileType
FindClose
FindNextFileW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime
GetVersionExW
GetSystemTimeAsFileTime
GetTickCount64
GetSystemInfo

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW
GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W

api-ms-win-service-management-l1-1-0

StartServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
OpenServiceW
CreateServiceW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus
ControlService

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW

ws2_32

WSACleanup
WSAStartup

api-ms-win-shell-shdirectory-l1-1-0

ord290

ext-ms-win-shell32-shellfolders-l1-1-0

SHGetFolderPathW

oleaut32

SysAllocStringLen

api-ms-win-core-heap-l2-1-0

LocalAlloc
GlobalAlloc
GlobalFree
LocalFree

api-ms-win-core-processenvironment-l1-1-0

SetStdHandle
GetCommandLineW
SetEnvironmentVariableW
GetStdHandle
GetEnvironmentStringsW
GetCommandLineA
ExpandEnvironmentStringsW
FreeEnvironmentStringsW

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-memory-l1-1-0

ReadProcessMemory

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-io-l1-1-0

GetOverlappedResult
DeviceIoControl

api-ms-win-core-namedpipe-l1-1-0

WaitNamedPipeW

api-ms-win-core-psapi-l1-1-0

K32EnumProcesses
K32EnumProcessModules
K32GetModuleBaseNameW

api-ms-win-core-heap-obsolete-l1-1-0

GlobalHandle
GlobalLock
GlobalUnlock

rpcrt4

UuidToStringW
RpcStringFreeW

ext-ms-win-networking-wlanapi-l1-1-0

WlanQueryInterface
WlanOpenHandle
WlanCloseHandle
WlanFreeMemory
WlanEnumInterfaces

wlanapi

WlanIhvControl

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW

dbghelp

MiniDumpWriteDump

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW
LCMapStringW
IsValidLocale
IsValidCodePage
FormatMessageW
EnumSystemLocalesW
GetACP
GetOEMCP
GetCPInfo
GetUserDefaultLCID

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx
RtlUnwind
RtlVirtualUnwind
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InitializeSListHead
InterlockedFlushSList

api-ms-win-core-fibers-l1-1-0

FlsAlloc
FlsFree
FlsGetValue
FlsSetValue

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-console-l1-1-0

ReadConsoleW
SetConsoleCtrlHandler
GetConsoleCP
GetConsoleMode
WriteConsoleW

Sections

.text
Size: 426KB - Virtual size: 425KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5f7fc48274cb7ae0575cae60c0c0a8dc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-util-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-security-base-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-core-l1-1-0

ws2_32

api-ms-win-shell-shdirectory-l1-1-0

ext-ms-win-shell32-shellfolders-l1-1-0

oleaut32

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-memory-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

rpcrt4

ext-ms-win-networking-wlanapi-l1-1-0

wlanapi

setupapi

dbghelp

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-console-l1-1-0

Sections

.text Size: 426KB - Virtual size: 425KB

.rdata Size: 137KB - Virtual size: 136KB

.data Size: 4KB - Virtual size: 18KB

.pdata Size: 24KB - Virtual size: 23KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 426KB - Virtual size: 425KB

.rdata
Size: 137KB - Virtual size: 136KB

.data
Size: 4KB - Virtual size: 18KB

.pdata
Size: 24KB - Virtual size: 23KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 568KB - Virtual size: 572KB