4ea3ed8c746a26ee117c18395fb32cc96ebb8a4745f38c50d0d8758f8d81819c

Sharing

Copy URL

Twitter E-mail

General

Target

4ea3ed8c746a26ee117c18395fb32cc96ebb8a4745f38c50d0d8758f8d81819c
Size

1.4MB
MD5

6efe806263f623e77764f57da7003d93
SHA1

ff0a64f1b6646bc5a88a21061d41361977fb9f6d
SHA256

4ea3ed8c746a26ee117c18395fb32cc96ebb8a4745f38c50d0d8758f8d81819c
SHA512

909a71f67851de27e6e40dc4e13dc7c69e9a1315707a6303eca9f2d632f8cdcd6e6447f03d3f933dfae048995ef91060108b94c8fd316b30f3aec476f362b9cc
SSDEEP

12288:UL6lG8LZ1uDAJaFWmgPvEyDPIm2TV6PFl+rJRis0/88KC4dDpheDV1t:66lXDuSWWmijPz2MPOOsx8KCwzeh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4ea3ed8c746a26ee117c18395fb32cc96ebb8a4745f38c50d0d8758f8d81819c

Files

4ea3ed8c746a26ee117c18395fb32cc96ebb8a4745f38c50d0d8758f8d81819c
.exe windows:10 windows x64 arch:x64

2a69d7432cce70de2672963579bd0d88

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

GameInputSvc.pdb

Imports

ntdll

RtlUnhandledExceptionFilter
RtlAllocateHeap
RtlGetVersion
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlInitUnicodeString
EtwEventWriteTransfer
NtTerminateProcess
swprintf_s
RtlFreeHeap
NtQueryLicenseValue
EtwEventUnregister
_wcsicmp
RtlAdjustPrivilege
LdrResSearchResource
_wcsnicmp
EtwEventRegister
wcscpy_s
VerSetConditionMask
towlower
memset

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
CreateEventW
OpenEventW
WaitForSingleObject
SetEvent

api-ms-win-core-errorhandling-l1-1-0

GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW
GetFileVersionInfoSizeW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-file-l1-1-0

GetFullPathNameW
CreateFileW
GetTempFileNameW
GetFileAttributesW
GetVolumePathNameW
DeleteFileW
SetFileAttributesW

api-ms-win-core-file-l2-1-0

CopyFileExW
MoveFileExW

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FreeLibrary
GetModuleFileNameW
GetProcAddress

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemDirectoryW

api-ms-win-core-wow64-l1-1-1

GetSystemWow64DirectoryW

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW
SetServiceStatus
StartServiceCtrlDispatcherW

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
TerminateProcess
GetCurrentProcess
CreateThread
GetExitCodeProcess
GetStartupInfoW
CreateProcessAsUserW

api-ms-win-security-base-l1-1-0

GetSecurityDescriptorSacl
AdjustTokenPrivileges
GetSecurityDescriptorOwner
DuplicateTokenEx
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
SetTokenInformation

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-kernel32-legacy-l1-1-0

WTSGetActiveConsoleSessionId
MoveFileW

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-security-provider-l1-1-0

GetNamedSecurityInfoW
SetNamedSecurityInfoW

ext-ms-win-session-wtsapi32-l1-1-0

WTSEnumerateSessionsW
WTSFreeMemory

crypt32

CertVerifyCertificateChainPolicy

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 660B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.sinit
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2a69d7432cce70de2672963579bd0d88

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-wow64-l1-1-1

api-ms-win-service-core-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-security-provider-l1-1-0

ext-ms-win-session-wtsapi32-l1-1-0

crypt32

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-errorhandling-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

wintrust

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 512B - Virtual size: 3KB

.pdata Size: 1024B - Virtual size: 660B

.sinit Size: 512B - Virtual size: 32B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1.4MB - Virtual size: 1.4MB

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 512B - Virtual size: 3KB

.pdata
Size: 1024B - Virtual size: 660B

.sinit
Size: 512B - Virtual size: 32B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1.4MB - Virtual size: 1.4MB