dCb40PYHyuv6ZHKkUB4t[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

dCb40PYHyuv6ZHKkUB4t.exe
Size

1.3MB
MD5

748a0e1c69ba4dfc34cd7373566eda61
SHA1

8d7cbaefc393c2a2de889ec89e740fbc8c0310ca
SHA256

e06a291c6e88dece7dd46755db6870af1b8f86ebdd6d2778c11c8d5f39f9e599
SHA512

b9744c8829366dfdb00a70cac70e6791207e1db5db9bb04d3c90c71062807ffaa9a5d5872ba87a89c19b109497a5189be811e59a297336247a9785be9806b750
SSDEEP

24576:NYxZjfDrYYzmZwRmhKgPWWa1DvMdZxrnaC2fQlYYNaJy:NYnjwYzoCgPE1DMnd2IG8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dCb40PYHyuv6ZHKkUB4t.exe

Files

dCb40PYHyuv6ZHKkUB4t.exe
.exe windows:6 windows x64 arch:x64

94478010c04bcc3fb5658d6c38b7adc2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\msys64\home\henrikn\visual_studio_projects\order_90_loader\Release\loader.pdb

Imports

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
LoadLibraryW
GetTickCount
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
SleepConditionVariableSRW
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
HeapFree
HeapAlloc
CloseHandle
ReadFile
GetFileSizeEx
CreateFileA
MultiByteToWideChar
GlobalAlloc
RtlLookupFunctionEntry
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock

user32

RegisterClassExW
CreateWindowExW
DestroyWindow
DefWindowProcW
GetSystemMetrics
UnregisterClassW
ShowWindow
DispatchMessageW
SetClipboardData
PeekMessageW
MoveWindow
TranslateMessage
LoadIconW
PostQuitMessage
UpdateWindow
GetKeyState
ScreenToClient
GetClipboardData
EmptyClipboard
CloseClipboard
GetWindowRect
OpenClipboard
GetCursorPos
SetCursorPos
ReleaseCapture
IsWindowUnicode
SetProcessDPIAware
GetClientRect
SetCursor
SetCapture
LoadCursorW
GetCapture
GetForegroundWindow
ClientToScreen
TrackMouseEvent

shell32

ShellExecuteW

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

imm32

ImmSetCompositionWindow
ImmGetContext
ImmSetCandidateWindow
ImmReleaseContext

dwmapi

DwmExtendFrameIntoClientArea

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__intrinsic_setjmp
__C_specific_handler
__current_exception_context
__current_exception
memcmp
memchr
memset
memmove
memcpy
longjmp
strrchr
__std_terminate
__std_exception_copy
__std_exception_destroy
_CxxThrowException
strstr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__acrt_iob_func
ftell
__stdio_common_vfprintf
fflush
fclose
fwrite
__p__commode
__stdio_common_vsscanf
fread
__stdio_common_vsprintf
_wfopen
fseek

api-ms-win-crt-utility-l1-1-0

rand
qsort

api-ms-win-crt-string-l1-1-0

strcmp
strncmp
strncpy

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

_c_exit
_wassert
_invalid_parameter_noinfo_noreturn
terminate
_configure_narrow_argv
_initialize_narrow_environment
_exit
exit
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm
_get_narrow_winmain_command_line
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-math-l1-1-0

powf
roundf
__setusermatherr
sin
sinf
pow
fmodf
cos
sqrtf
ceilf
acosf
cosf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 684KB - Virtual size: 683KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 221KB - Virtual size: 221KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 361KB - Virtual size: 362KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

94478010c04bcc3fb5658d6c38b7adc2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

d3d11

d3dcompiler_43

kernel32

user32

shell32

msvcp140

imm32

dwmapi

d3dx11_43

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 684KB - Virtual size: 683KB

.rdata Size: 221KB - Virtual size: 221KB

.data Size: 361KB - Virtual size: 362KB

.pdata Size: 34KB - Virtual size: 33KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 684KB - Virtual size: 683KB

.rdata
Size: 221KB - Virtual size: 221KB

.data
Size: 361KB - Virtual size: 362KB

.pdata
Size: 34KB - Virtual size: 33KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 3KB - Virtual size: 3KB