drg_mod_integration[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

drg_mod_integration.exe
Size

21.5MB
MD5

70386c0fe5b1f357f454a16f5f484355
SHA1

0f36dc8b5149372c7675c443f278c090c49be61a
SHA256

4fc8c0d63449566dff2fbf88e4c61ee0d1194c3a756140aeaee1e3cf3ea73fed
SHA512

28e4148272fbc6b839ce67cfa1304ba91c764fbd0dbe389c77c94c0730d8ec640a53d3ceabe8501ffd844ccf2332c9413c9f9830211001eb60a1d305b1672e26
SSDEEP

196608:Qvc1khqNi6we8kBMM2B6bkbj8ED80ta0tn6XA2VyCo:l10q2ex2Mkakbj88tntngA2VyCo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
drg_mod_integration.exe

Files

drg_mod_integration.exe
.exe windows:6 windows x64 arch:x64

fb5af84148ad72f1fbcbb24c4cfcfc28

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\drg-mod-integration\drg-mod-integration\target\x86_64-pc-windows-msvc\dist\deps\drg_mod_integration.pdb

Imports

kernel32

FlsFree
CompareStringW
LCMapStringW
FormatMessageW
WaitForSingleObject
GetConsoleOutputCP
HeapAlloc
FindFirstFileExW
FreeLibrary
LoadLibraryA
FlsSetValue
HeapFree
GetProcessHeap
FlsGetValue
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
FlsAlloc
GetCommandLineA
TlsFree
SetStdHandle
GetStringTypeW
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
SetHandleInformation
GetCurrentProcessId
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetFullPathNameW
HeapSize
MoveFileExW
SleepConditionVariableSRW
LoadLibraryExW
RtlVirtualUnwind
GetCurrentProcess
DuplicateHandle
GetSystemInfo
PostQueuedCompletionStatus
SetFileAttributesW
TryAcquireSRWLockExclusive
CreateIoCompletionPort
GetFileInformationByHandleEx
GetQueuedCompletionStatusEx
WriteFile
GetSystemTimeAsFileTime
SetFileCompletionNotificationModes
CreateThread
WriteConsoleW
GetFileAttributesW
CreateProcessW
GetWindowsDirectoryW
GetSystemDirectoryW
CreateNamedPipeW
ReadConsoleInputW
ExitProcess
GetModuleHandleW
GetNumberOfConsoleInputEvents
GetFinalPathNameByHandleW
FillConsoleOutputAttribute
DeleteFileW
FindFirstFileW
CreateDirectoryW
GetFileInformationByHandle
FindNextFileW
HeapReAlloc
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentThreadId
WakeConditionVariable
WakeAllConditionVariable
TerminateProcess
GetExitCodeProcess
ReadFileEx
SleepEx
WriteFileEx
SetFilePointerEx
FlushFileBuffers
GetCommandLineW
FillConsoleOutputCharacterA
SetEnvironmentVariableW
GetEnvironmentVariableW
GetEnvironmentStringsW
GetCurrentDirectoryW
SetLastError
SwitchToThread
SetThreadStackGuarantee
AddVectoredExceptionHandler
CompareStringOrdinal
SetConsoleCursorPosition
GetConsoleScreenBufferInfo
SetConsoleMode
FindClose
FreeEnvironmentStringsW
CreateMutexA
WaitForSingleObjectEx
RtlLookupFunctionEntry
LoadLibraryW
GetModuleHandleExW
GetModuleFileNameW
SetThreadErrorMode
ReleaseMutex
RtlCaptureContext
Sleep
GetCurrentThread
GetFileType
GlobalLock
GlobalSize
GlobalUnlock
SetConsoleTextAttribute
lstrlenW
GlobalAlloc
CreateFileW
GlobalFree
WideCharToMultiByte
MultiByteToWideChar
GetConsoleMode
GetStdHandle
GetLastError
GetModuleHandleA
GetProcAddress
CloseHandle
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared

advapi32

RegCloseKey
SystemFunction036
RegQueryValueExW
RegOpenKeyExW

shell32

DragQueryFileW
SHGetKnownFolderPath
DragFinish
ShellExecuteW
SHCreateItemFromParsingName

user32

IsClipboardFormatAvailable
OpenClipboard
EmptyClipboard
CloseClipboard
SetClipboardData
GetClassInfoExW
GetPropW
CallWindowProcW
GetClassNameW
GetDC
IsIconic
GetWindowRect
GetMonitorInfoW
MonitorFromWindow
CloseTouchInputHandle
GetTouchInputInfo
SetCursor
LoadCursorW
SetPropW
TrackMouseEvent
MonitorFromRect
GetMenu
ScreenToClient
GetUpdateRect
ValidateRect
SetWindowPlacement
GetWindowPlacement
ChangeDisplaySettingsExW
DefWindowProcW
PostThreadMessageW
SetWindowLongPtrW
GetMessageW
MapVirtualKeyA
RegisterClipboardFormatW
FlashWindowEx
GetForegroundWindow
ReleaseCapture
GetCursorPos
GetClientRect
CreateWindowExW
RegisterClassExW
InvalidateRgn
SetWindowPos
SetWindowDisplayAffinity
ClientToScreen
RemovePropW
RegisterTouchWindow
RegisterRawInputDevices
GetWindowLongPtrW
DispatchMessageW
TranslateMessage
PeekMessageW
SystemParametersInfoA
CreateIconFromResourceEx
SendMessageW
GetSystemMetrics
GetActiveWindow
DestroyWindow
PostMessageW
ReleaseDC
RedrawWindow
RegisterWindowMessageA
ShowCursor
ClipCursor
GetClipCursor
MsgWaitForMultipleObjectsEx
AdjustWindowRectEx
GetWindowLongW
SetCapture
EnableMenuItem
GetSystemMenu
SetWindowLongW
ShowWindow
SetForegroundWindow
DestroyIcon
IsProcessDPIAware
SendInput
GetClipboardData
CreateIcon
GetKeyState
GetKeyboardState
GetKeyboardLayout
ToUnicodeEx
MapVirtualKeyW
EnumDisplayMonitors
MonitorFromPoint
GetRawInputData
SetWindowTextW

ole32

CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitializeEx
OleInitialize
RevokeDragDrop
RegisterDragDrop

oleaut32

SysStringLen
GetErrorInfo
SysFreeString
SysAllocStringLen
SetErrorInfo
SafeArrayCreateVector
SafeArrayPutElement

ws2_32

connect
bind
WSASocketW
getpeername
getsockname
send
WSASend
listen
setsockopt
WSAIoctl
accept
ioctlsocket
closesocket
WSAStartup
getsockopt
WSARecv
WSAGetLastError
select
recv
shutdown
freeaddrinfo
WSACleanup
getaddrinfo

secur32

EncryptMessage
DecryptMessage
FreeContextBuffer
AcquireCredentialsHandleA
FreeCredentialsHandle
AcceptSecurityContext
QueryContextAttributesW
InitializeSecurityContextW
DeleteSecurityContext
ApplyControlToken

crypt32

CertVerifyCertificateChainPolicy
CertDuplicateStore
CertFreeCertificateContext
CertDuplicateCertificateContext
CertGetCertificateChain
CertDuplicateCertificateChain
CertFreeCertificateChain
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertOpenStore
CertCloseStore

ntdll

NtCreateFile
NtCancelIoFileEx
NtReadFile
NtWriteFile
RtlNtStatusToDosError
NtDeviceIoControlFile

opengl32

wglGetCurrentDC
wglDeleteContext
wglGetProcAddress
wglGetCurrentContext
wglCreateContext
wglMakeCurrent
wglShareLists

gdi32

SwapBuffers
CreateRectRgn
DescribePixelFormat
DeleteObject
SetPixelFormat
ChoosePixelFormat
GetDeviceCaps

dwmapi

DwmEnableBlurBehindWindow

shlwapi

AssocQueryStringW

uiautomationcore

UiaLookupId
UiaHostProviderFromHwnd
UiaGetReservedNotSupportedValue
UiaRaiseAutomationPropertyChangedEvent
UiaRaiseAutomationEvent
UiaReturnRawElementProvider

winmm

timeEndPeriod
timeBeginPeriod
timeGetDevCaps

uxtheme

SetWindowTheme

imm32

ImmAssociateContextEx
ImmSetCandidateWindow
ImmGetCompositionStringW
ImmGetContext
ImmReleaseContext

bcrypt

BCryptGenRandom

Sections

.text
Size: 13.3MB - Virtual size: 13.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7.5MB - Virtual size: 7.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 624KB - Virtual size: 623KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fb5af84148ad72f1fbcbb24c4cfcfc28

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

shell32

user32

ole32

oleaut32

ws2_32

secur32

crypt32

ntdll

opengl32

gdi32

dwmapi

shlwapi

uiautomationcore

winmm

uxtheme

imm32

bcrypt

Sections

.text Size: 13.3MB - Virtual size: 13.3MB

.rdata Size: 7.5MB - Virtual size: 7.5MB

.data Size: 19KB - Virtual size: 35KB

.pdata Size: 624KB - Virtual size: 623KB

_RDATA Size: 512B - Virtual size: 244B

.reloc Size: 88KB - Virtual size: 87KB

.text
Size: 13.3MB - Virtual size: 13.3MB

.rdata
Size: 7.5MB - Virtual size: 7.5MB

.data
Size: 19KB - Virtual size: 35KB

.pdata
Size: 624KB - Virtual size: 623KB

_RDATA
Size: 512B - Virtual size: 244B

.reloc
Size: 88KB - Virtual size: 87KB