0111ecd87938ef5d2ae6485be1d80b5c83c067e44e2d05c2be9bd500846fe5c2

Sharing

Copy URL Twitter E-mail

General

Target

0111ecd87938ef5d2ae6485be1d80b5c83c067e44e2d05c2be9bd500846fe5c2
Size

4.3MB
MD5

f96743925cf734c324778c4f9712aa90
SHA1

9a32a673b49de1ef14cc001450f1d038fea94567
SHA256

0111ecd87938ef5d2ae6485be1d80b5c83c067e44e2d05c2be9bd500846fe5c2
SHA512

e32c224e0dd6caaef7af90b4f2fb487c23ea361bc767331b31d4c682f2c81d4e16f00f5efb374c3e2d4f9942bce9153471ed27f5e2dc38cecdf89dd953df0712
SSDEEP

98304:QfCjKYWpcq8wP4LPMHa3iWQDxUEL/e69L3HclEKpm67Nrplt1CFFrOG:mwK9cq8p3ixt3HclEKpmc9Cfj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0111ecd87938ef5d2ae6485be1d80b5c83c067e44e2d05c2be9bd500846fe5c2

Files

0111ecd87938ef5d2ae6485be1d80b5c83c067e44e2d05c2be9bd500846fe5c2
.exe windows:6 windows x86 arch:x86

bf0b87014c0eede5cc202a81173da9b2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\code\client\Gtarcade\Bin\Release\gtarucore.pdb

Imports

ws2_32

accept
listen
recvfrom
sendto
ioctlsocket
gethostname
shutdown
getservbyname
gethostbyname
htonl
closesocket
socket
WSAGetLastError
__WSAFDIsSet
select
WSASetLastError
recv
send
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSAIoctl
WSAStartup
WSACleanup
getaddrinfo
freeaddrinfo

kernel32

GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
IsValidLocale
GetTimeZoneInformation
GetConsoleCP
SetConsoleCtrlHandler
WriteConsoleW
ExitProcess
SetStdHandle
VirtualQuery
VirtualAlloc
GetSystemInfo
HeapQueryInformation
MoveFileExW
GetCommandLineW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
FreeEnvironmentStringsW
GetFileInformationByHandle
RtlUnwind
GetSystemTime
GlobalMemoryStatus
FlushConsoleInputBuffer
PeekNamedPipe
GetStdHandle
GetFileType
WaitForMultipleObjects
ExpandEnvironmentStringsA
QueryPerformanceFrequency
SleepEx
FormatMessageA
GetCPInfo
LCMapStringW
GetStringTypeW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
SetEnvironmentVariableW
SetConsoleMode
ReadConsoleInputW
CreateThread
UnhandledExceptionFilter
WaitForSingleObjectEx
GetUserDefaultLCID
GetProfileIntW
SearchPathW
GetWindowsDirectoryW
FindResourceExW
GetTempFileNameW
SystemTimeToTzSpecificLocalTime
GetFileTime
GetFileAttributesExW
FileTimeToLocalFileTime
SetErrorMode
VirtualProtect
VerifyVersionInfoW
lstrcpyW
VerSetConditionMask
lstrcmpiW
GetCurrentProcess
DuplicateHandle
UnlockFile
LockFile
GetVolumeInformationW
GetFullPathNameW
FlushFileBuffers
GlobalFlags
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringW
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
GetThreadLocale
FileTimeToSystemTime
GlobalGetAtomNameW
GlobalFindAtomW
LoadLibraryW
LoadLibraryA
GetModuleHandleA
GetSystemDirectoryW
EncodePointer
InitializeCriticalSectionAndSpinCount
GlobalAddAtomW
GetCurrentProcessId
GetPrivateProfileIntW
GetProcAddress
lstrcmpW
lstrcmpA
GlobalDeleteAtom
LoadLibraryExW
FreeLibrary
GetCurrentThread
ResumeThread
SetThreadPriority
GetCurrentThreadId
SetLastError
CopyFileW
FormatMessageW
MulDiv
LocalFree
GlobalSize
GetUserDefaultUILanguage
SetEndOfFile
SystemTimeToFileTime
GetCurrentDirectoryW
GetFileAttributesW
MultiByteToWideChar
GetCommandLineA
CreateMutexW
GetTickCount
OpenMutexW
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
ReleaseMutex
OpenEventW
OutputDebugStringW
OutputDebugStringA
FreeResource
GlobalUnlock
GetModuleHandleW
GlobalLock
ResetEvent
GlobalFree
GlobalAlloc
TerminateThread
SetEvent
GetPrivateProfileStringW
GetExitCodeThread
CreateEventW
lstrcpynW
WritePrivateProfileStringW
GetDriveTypeW
GetFileSize
GetNativeSystemInfo
CloseHandle
Process32FirstW
DeleteFileW
Process32NextW
Sleep
CreateToolhelp32Snapshot
OpenProcess
GetVersionExW
CreateFileW
WaitForSingleObject
FindClose
GetTempPathW
SetFilePointer
GetModuleFileNameW
RemoveDirectoryW
TerminateProcess
WriteFile
lstrlenW
FindNextFileW
GetFileSizeEx
FindFirstFileW
ReadFile
CreateDirectoryW
WideCharToMultiByte
FindResourceW
LoadResource
LockResource
SizeofResource
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
HeapFree
SetFilePointerEx

user32

IsRectEmpty
IntersectRect
InvalidateRgn
CopyAcceleratorTableW
OffsetRect
CharNextW
CharUpperW
DestroyIcon
WindowFromPoint
ReleaseCapture
SetCapture
WaitMessage
RealChildWindowFromPoint
DeleteMenu
SystemParametersInfoW
CopyImage
GetSysColorBrush
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
GetDesktopWindow
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
IsDialogMessageW
SetWindowTextW
CheckDlgButton
MoveWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
GetTopWindow
GetClassLongW
CopyRect
GetSysColor
MapWindowPoints
AdjustWindowRectEx
GetWindowTextLengthW
GetWindowTextW
RemovePropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
EndPaint
BeginPaint
GetNextDlgGroupItem
MessageBeep
SetLayeredWindowAttributes
DrawStateW
FillRect
GetClassNameW
RegisterWindowMessageW
SetRectEmpty
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
SetFocus
GetDlgCtrlID
GetDlgItem
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
EnumDisplayMonitors
DestroyWindow
IsChild
IsMenu
DestroyMenu
GetMenuItemInfoW
InflateRect
SendDlgItemMessageA
GetAsyncKeyState
TrackMouseEvent
IsZoomed
LoadMenuW
GetSystemMenu
SetWindowRgn
NotifyWinEvent
CreatePopupMenu
GetMenuDefaultItem
SetMenuDefaultItem
EnableScrollBar
UnionRect
MonitorFromPoint
GetClassInfoW
RegisterClassW
CallWindowProcW
LoadAcceleratorsW
TranslateAcceleratorW
InsertMenuItemW
LoadImageW
UnpackDDElParam
ReuseDDElParam
RegisterClipboardFormatW
DrawEdge
DrawFrameControl
DrawFocusRect
DrawIconEx
ToUnicodeEx
GetKeyboardLayout
GetMessagePos
GetMessageTime
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetFocus
UnhookWindowsHookEx
MapDialogRect
GetKeyboardState
MapVirtualKeyW
CreateAcceleratorTableW
DestroyAcceleratorTable
SetCursorPos
SetParent
ReleaseDC
InvalidateRect
UpdateWindow
PtInRect
SetRect
UpdateLayeredWindow
GetClientRect
SetWindowLongW
SetCursor
LoadCursorW
ShowWindow
UnregisterClassW
ScreenToClient
SetWindowPos
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetDC
GetWindowRect
PostMessageW
GetWindowLongW
SetProcessDPIAware
EnableWindow
GetCursorPos
IsIconic
PostQuitMessage
KillTimer
LoadIconW
BringWindowToTop
ClientToScreen
SetTimer
IsWindow
DrawIcon
GetSystemMetrics
SendMessageW
FindWindowExW
LockWindowUpdate
GetClassInfoExW
SetPropW
RegisterClassExW
CreateWindowExW
GetPropW
DefWindowProcW
GetParent
EqualRect
GetMenuStringW
GetMenuState
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuW
AppendMenuW
RemoveMenu
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
IsWindowVisible
GetActiveWindow
GetKeyState
ValidateRect
SetWindowsHookExW
CallNextHookEx
ShowOwnedPopups
IsWindowEnabled
MessageBoxW
GetWindowThreadProcessId
GetLastActivePopup
SetWindowContextHelpId
GetWindow
SetClassLongW
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
CharUpperBuffW
ModifyMenuW
CopyIcon
FrameRect
PostThreadMessageW
GetKeyNameTextW
GetDoubleClickTime
GetIconInfo
IsCharLowerW
MapVirtualKeyExW
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
IsClipboardFormatAvailable
GetUpdateRect
SubtractRect
CreateMenu
HideCaret
InvertRect
DestroyCursor
GetComboBoxInfo
GetWindowRgn
GetWindowPlacement

gdi32

SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetTextAlign
MoveToEx
TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
GetBkColor
GetTextColor
CreateRectRgnIndirect
GetRgnBox
CreateCompatibleBitmap
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
GetTextMetricsW
GetTextExtentPoint32W
CreateRoundRectRgn
CombineRgn
GetMapMode
PatBlt
LineTo
DPtoLP
CreateEllipticRgn
Ellipse
CreatePolygonRgn
Polygon
Polyline
EnumFontFamiliesExW
SetPixel
StretchBlt
SetDIBColorTable
OffsetRgn
Rectangle
RoundRect
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
LPtoDP
ExtFloodFill
SetPaletteEntries
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
GetWindowOrgEx
GetViewportOrgEx
SetPixelV
GetTextFaceW
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
BitBlt
SetTextColor
SetBkColor
GetStockObject
SetBkMode
SelectPalette
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
RealizePalette
CreateSolidBrush
CreateBitmap
GetDeviceCaps
CreateDCW
CopyMetaFileW
GetObjectW
CreateFontIndirectW
SelectObject
CreateDIBSection
CreateCompatibleDC
DeleteDC
SetRectRgn
SetROP2
DeleteObject

msimg32

TransparentBlt
AlphaBlend

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

advapi32

DeregisterEventSource
ReportEventA
CryptEnumProvidersA
CryptSignHashA
CryptAcquireContextA
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegisterEventSourceA

shell32

SHFileOperationW
ShellExecuteExW
SHGetFolderPathW
Shell_NotifyIconW
SHBrowseForFolderW
SHAppBarMessage
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetPathFromIDListW
DragFinish
DragQueryFileW
ShellExecuteW
SHGetFileInfoW

comctl32

_TrackMouseEvent
InitCommonControlsEx

shlwapi

PathIsDirectoryW
PathFileExistsW
PathUnquoteSpacesW
PathFindExtensionW
PathFindFileNameW
PathIsUNCW
wnsprintfW
PathRemoveFileSpecW
StrFormatKBSizeW
PathStripToRootW

uxtheme

GetThemePartSize
DrawThemeParentBackground
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
CloseThemeData
OpenThemeData
IsAppThemed
DrawThemeText
GetWindowTheme
GetThemeSysColor
IsThemeBackgroundPartiallyTransparent

ole32

CoInitialize
CoUninitialize
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
CoRegisterMessageFilter
CoRevokeClassObject
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoDisconnectObject
CLSIDFromProgID
CLSIDFromString
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
CoCreateGuid
CoCreateInstance
CoInitializeEx
CreateStreamOnHGlobal

oleaut32

SafeArrayDestroy
SystemTimeToVariantTime
SysStringLen
VariantChangeType
VariantClear
VariantInit
SysAllocStringLen
SysAllocString
SysFreeString
LoadTypeLi
OleCreateFontIndirect
VariantCopy
VariantTimeToSystemTime
VarBstrFromDate

oledlg

OleUIBusyW

gdiplus

GdipDrawImageI
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageGraphicsContext
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipFree
GdipLoadImageFromStream
GdiplusShutdown
GdipGetImageHeight
GdipReleaseDC
GdipDrawImageRectRect
GdipCreateFromHDC
GdipDeleteGraphics
GdipGetImageWidth
GdipDrawImagePointRectI

iphlpapi

GetAdaptersInfo

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmGetContext
ImmReleaseContext
ImmGetOpenStatus

winmm

PlaySoundW

wldap32

ord27
ord26
ord118
ord41
ord208
ord127
ord14
ord46
ord219
ord145
ord301
ord167
ord147
ord79
ord216
ord133
ord142

crypt32

CertDuplicateCertificateContext
CertCloseStore
CertOpenStore
CertFreeCertificateContext
CertEnumCertificatesInStore
CertFindCertificateInStore
CertGetCertificateContextProperty

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 708KB - Virtual size: 707KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 65KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.giats
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 403KB - Virtual size: 402KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 256KB - Virtual size: 256KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bf0b87014c0eede5cc202a81173da9b2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

iphlpapi

oleacc

imm32

winmm

wldap32

crypt32

Sections

.text Size: 2.8MB - Virtual size: 2.8MB

.rdata Size: 708KB - Virtual size: 707KB

.data Size: 65KB - Virtual size: 113KB

.gfids Size: 107KB - Virtual size: 106KB

.giats Size: 512B - Virtual size: 16B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 403KB - Virtual size: 402KB

.reloc Size: 256KB - Virtual size: 256KB

.text
Size: 2.8MB - Virtual size: 2.8MB

.rdata
Size: 708KB - Virtual size: 707KB

.data
Size: 65KB - Virtual size: 113KB

.gfids
Size: 107KB - Virtual size: 106KB

.giats
Size: 512B - Virtual size: 16B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 403KB - Virtual size: 402KB

.reloc
Size: 256KB - Virtual size: 256KB