93e9bc3c2b335f193e99b34f06d53239cb2d08558516598483bc945b3a8b7c0b

Sharing

Copy URL Twitter E-mail

General

Target

93e9bc3c2b335f193e99b34f06d53239cb2d08558516598483bc945b3a8b7c0b
Size

2.9MB
MD5

b1438473d48ea72b73428be57c49d97f
SHA1

744028f16087fd3cab61fc2287289fc2011ef2ac
SHA256

93e9bc3c2b335f193e99b34f06d53239cb2d08558516598483bc945b3a8b7c0b
SHA512

ec8fde9ef4d4f06aa6d3c343b52109c6fd32ef7f1ca166169152c8b365adc90db726d7223d642aca83bd9e5c0bbf66a67795e53f6e87f54d1c173cb39e128a98
SSDEEP

49152:lKkuqaBTPEpLbNsPyrko79QbKpoFfJVTZqs8t3cZF1eMJyPsi1IYfYlFHYKscg:lKh3TPgVsawo5QbqoRZf8tsZF1ji2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
93e9bc3c2b335f193e99b34f06d53239cb2d08558516598483bc945b3a8b7c0b

Files

93e9bc3c2b335f193e99b34f06d53239cb2d08558516598483bc945b3a8b7c0b
.exe windows:5 windows x86 arch:x86

a2deaf7790f9d3e58f3e885113f1ba85

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\client_build\client_build.WIN\PRODUCTION\PokerStars\COM\gameutil\Release\Win32\bin\gameutil2.pdb

Imports

pdh

PdhAddCounterA
PdhOpenQueryA
PdhCollectQueryData
PdhGetFormattedCounterValue

wsock32

WSASetLastError
listen
bind
accept
htonl
inet_ntoa
connect
WSAGetLastError
WSACleanup
WSAStartup
gethostname
gethostbyname
socket
setsockopt
send
select
recv
ntohs
ntohl
getsockopt
closesocket
ioctlsocket
htons
shutdown

kernel32

FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExW
FindFirstFileExA
GetTickCount
GetThreadTimes
InitializeCriticalSection
DeleteCriticalSection
GetLastError
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
GetCurrentProcess
TerminateProcess
OpenProcess
CloseHandle
GetCurrentThreadId
GetCurrentProcessId
FindClose
FileTimeToSystemTime
GetFileAttributesW
FindFirstFileW
FindNextFileW
CopyFileW
MoveFileW
FormatMessageA
SetLastError
GetSystemTime
GetSystemTimeAsFileTime
GetLocalTime
GetTimeZoneInformation
SystemTimeToFileTime
FileTimeToLocalFileTime
MultiByteToWideChar
GetFileSize
WriteFile
ReadFile
FlushFileBuffers
SetFilePointer
CreateFileA
SetEvent
ResetEvent
ReleaseMutex
WaitForMultipleObjects
MapViewOfFile
UnmapViewOfFile
CreateMutexA
OpenMutexA
CreateEventA
OpenEventA
CreateFileMappingA
OpenFileMappingA
GetProcessAffinityMask
GetModuleHandleA
CreateFileW
GetExitCodeProcess
CreateProcessA
RegisterWaitForSingleObject
UnregisterWait
GetOverlappedResult
FreeLibrary
GetProcAddress
LoadLibraryExA
GetSystemDirectoryA
GetVolumeInformationA
GetCurrentThread
SetThreadPriority
EnumSystemLocalesW
ReleaseSemaphore
Sleep
CreateSemaphoreA
GlobalAlloc
SetEnvironmentVariableW
GlobalUnlock
lstrcmpW
GetModuleFileNameA
GetModuleFileNameW
CreateProcessW
GetSystemDirectoryW
GetWindowsDirectoryA
GetWindowsDirectoryW
SetCurrentDirectoryA
SetCurrentDirectoryW
GetCurrentDirectoryA
GetCurrentDirectoryW
GetVersionExA
GetProcessTimes
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
HeapReAlloc
HeapFree
GetACP
SetConsoleMode
ReadConsoleInputA
PeekConsoleInputA
GetConsoleCP
GetNumberOfConsoleInputEvents
GetConsoleMode
SetConsoleCtrlHandler
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
DeleteFileW
RemoveDirectoryW
CreateDirectoryW
GetFullPathNameA
GetFullPathNameW
GetDriveTypeW
LoadLibraryExW
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
RaiseException
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
CreateEventW
InitializeCriticalSectionAndSpinCount
DecodePointer
EncodePointer
MoveFileExW
GetProcessHeap
OutputDebugStringA
OutputDebugStringW
WriteConsoleW
HeapSize
SetEnvironmentVariableA
HeapAlloc
SetStdHandle
ReadConsoleW
SetFilePointerEx
GlobalLock
SetEndOfFile
PulseEvent
FindFirstFileA
GetStdHandle
GetFileType
QueryPerformanceCounter
LoadLibraryA
GlobalMemoryStatus
FlushConsoleInputBuffer
QueryPerformanceFrequency
GetCPInfo

user32

SetTimer
LoadStringA
LoadIconA
LoadCursorA
GetClientRect
EndPaint
BeginPaint
UpdateWindow
DrawTextA
TranslateAcceleratorA
LoadAcceleratorsA
EndDialog
DialogBoxParamA
ShowWindow
DestroyWindow
CreateWindowExA
RegisterClassExA
PostQuitMessage
DefWindowProcA
DispatchMessageA
TranslateMessage
GetMessageA
LoadImageW
SetWindowsHookExW
SetWindowLongW
GetWindowLongW
MessageBoxW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
DrawTextW
AppendMenuW
GetSystemMetrics
GetKeyState
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
CreateDialogIndirectParamW
SetWindowPos
CreateWindowExW
GetClassInfoExW
CallWindowProcW
DefWindowProcW
PostThreadMessageW
PostMessageW
SendMessageW
PeekMessageW
DispatchMessageW
GetMessageW
IsWindow
KillTimer
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
GetDC
ReleaseDC
RegisterClassExW

gdi32

GetObjectA
SetDIBits
SelectObject
GetDIBits
DeleteObject
CreateCompatibleBitmap
GetDeviceCaps

advapi32

RegSetValueExA
ReportEventA
RegisterEventSourceA
DeregisterEventSource
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 557KB - Virtual size: 556KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a2deaf7790f9d3e58f3e885113f1ba85

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

pdh

wsock32

kernel32

user32

gdi32

advapi32

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 557KB - Virtual size: 556KB

.data Size: 44KB - Virtual size: 58KB

.rsrc Size: 32KB - Virtual size: 32KB

.reloc Size: 112KB - Virtual size: 111KB

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 557KB - Virtual size: 556KB

.data
Size: 44KB - Virtual size: 58KB

.rsrc
Size: 32KB - Virtual size: 32KB

.reloc
Size: 112KB - Virtual size: 111KB