fd47df5849b263ebbd93a929f94d6bae649c928d8511717a7beda1488efa2702

Sharing

Copy URL Twitter E-mail

General

Target

fd47df5849b263ebbd93a929f94d6bae649c928d8511717a7beda1488efa2702
Size

276KB
MD5

a863f93e0cfde18129a7c099da003fc7
SHA1

9bf8f8202e338e5dcb3bd5f0c7746d04dd078112
SHA256

fd47df5849b263ebbd93a929f94d6bae649c928d8511717a7beda1488efa2702
SHA512

1467364948b96f96d36f62fe70a64f4ae17e76809947d491b4ad9698d13eb9870cb0263e739ad7a9c54e9f3513e77ff3c637b30ba8ffb2507c14d4a67c15e186
SSDEEP

6144:Lt/6Sj/lXGkmcHG+Wa6FuGRmMY1bc5FyR1s85zNGxlF06y5N8:Lt/6Sj/lXGv+T6pmMY1CxT6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fd47df5849b263ebbd93a929f94d6bae649c928d8511717a7beda1488efa2702

Files

fd47df5849b263ebbd93a929f94d6bae649c928d8511717a7beda1488efa2702
.dll windows:10 windows x64 arch:x64

95384066597a9619d1c5a2c24f869ce6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

GraphicsPerfSvc.pdb

Imports

msvcp_win

_Cnd_do_broadcast_at_thread_exit
_Cnd_timedwait
_Query_perf_counter
_Thrd_detach
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
_Xtime_get_ticks
_Cnd_destroy_in_situ
_Mtx_destroy_in_situ
_Thrd_hardware_concurrency
_Mtx_current_owns
_Query_perf_frequency
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
_Mtx_init_in_situ
_Cnd_broadcast
_Cnd_register_at_thread_exit
_Cnd_init_in_situ
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
_Mtx_lock
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_unlock
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
_Cnd_wait
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
_Cnd_unregister_at_thread_exit

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_abort
_o_ceilf
_o_free
_o_iswspace
_o_malloc
_o_terminate
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vfprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
_o__aligned_malloc
_o__callnewh
_o__aligned_free
_o___acrt_iob_func
__std_terminate
__CxxFrameHandler4
_o___stdio_common_vswprintf
_o__beginthreadex
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
DisableThreadLibraryCalls
GetProcAddress
FreeLibrary
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExA

api-ms-win-core-synch-l1-1-0

CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
CreateSemaphoreExW
ReleaseSemaphore
CreateEventExW
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
IsThreadpoolTimerSet

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetExitCodeProcess
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-com-l1-1-0

CoRegisterClassObject
CoDisconnectContext
CoFreeUnusedLibraries
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoTaskMemFree
CoRevokeClassObject
CoCreateInstance

api-ms-win-shcore-thread-l1-1-0

GetProcessReference
SetProcessReference

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventSetInformation
EventUnregister

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegCloseKey
RegGetValueA
RegGetValueW
RegSetValueExW
RegOpenKeyExW

ntdll

NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
NtQueryInformationProcess

api-ms-win-core-psapi-l1-1-0

K32GetProcessMemoryInfo
K32QueryWorkingSet

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemInfo

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-eventing-controller-l1-1-0

ControlTraceW
EnableTraceEx2
StartTraceW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameA

api-ms-win-core-psapi-ansi-l1-1-0

QueryFullProcessImageNameA

api-ms-win-core-kernel32-legacy-l1-1-0

UnregisterWait

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-eventing-tdh-l1-1-0

TdhGetEventInformation
TdhGetPropertySize

api-ms-win-eventing-consumer-l1-1-0

OpenTraceW
CloseTrace
ProcessTrace

oleaut32

SetErrorInfo
GetErrorInfo
SysStringLen
SysFreeString
SysAllocString

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

Exports

Exports

DllMain
ServiceMain
SvchostPushServiceGlobalsEx

Sections

.text
Size: 180KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

fothk
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 988B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

95384066597a9619d1c5a2c24f869ce6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp_win

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-shcore-thread-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-registry-l1-1-0

ntdll

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-eventing-controller-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-psapi-ansi-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-eventing-tdh-l1-1-0

api-ms-win-eventing-consumer-l1-1-0

oleaut32

api-ms-win-core-libraryloader-l1-2-1

Exports

Exports

Sections

.text Size: 180KB - Virtual size: 176KB

fothk Size: 4KB - Virtual size: 4KB

.rdata Size: 60KB - Virtual size: 59KB

.data Size: 4KB - Virtual size: 5KB

.pdata Size: 16KB - Virtual size: 12KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 988B

.text
Size: 180KB - Virtual size: 176KB

fothk
Size: 4KB - Virtual size: 4KB

.rdata
Size: 60KB - Virtual size: 59KB

.data
Size: 4KB - Virtual size: 5KB

.pdata
Size: 16KB - Virtual size: 12KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 988B