39db31eda3b981781a6a80ddaf0c2906f837c56262991aaee217a66d9dca4639

Sharing

Copy URL Twitter E-mail

General

Target

39db31eda3b981781a6a80ddaf0c2906f837c56262991aaee217a66d9dca4639
Size

2.7MB
MD5

7918e28460595f8a706a07a9c077a934
SHA1

e5f2a8baa432b775fd454f40f120576f46bdc444
SHA256

39db31eda3b981781a6a80ddaf0c2906f837c56262991aaee217a66d9dca4639
SHA512

aac578d298a283a271bd1b7f490473f027eb8b3a36563e745234ee005ca0e5aa7e7749e184f384c1a3b570249cfe75e1d3e35596fc468bddd3251bb3406c27e2
SSDEEP

24576:eeuDO4OKoF+EwAsRFKsEOLvlr0lIMuiz19PHwiqzrXZrUeDVx6O8KyX/082PXcq3:ecs+s9Irz19s7DVx6dkXB9oyTS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
39db31eda3b981781a6a80ddaf0c2906f837c56262991aaee217a66d9dca4639

Files

39db31eda3b981781a6a80ddaf0c2906f837c56262991aaee217a66d9dca4639
.dll windows:5 windows x86 arch:x86

8e1415dfc7d214222da9615aa0cbbaf6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

H:\WorkSapce\Projects\BeiBei_SVN\trunk\bin\ddraw.pdb

Imports

kernel32

Process32First
Process32Next
Thread32First
Thread32Next
Module32First
Module32Next
DisableThreadLibraryCalls
CreateThread
ExitThread
GetTickCount
lstrcatA
LoadLibraryA
GetSystemDirectoryA
SetFileAttributesA
GetFileSize
ReadFile
FindClose
CreateMutexA
GetTempPathA
GetTempFileNameA
FindFirstFileA
CopyFileA
MoveFileExA
GetCurrentProcessId
OutputDebugStringA
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetModuleFileNameA
LoadLibraryExA
FormatMessageA
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
FindNextFileA
FindFirstFileExW
FindFirstFileExA
CreateToolhelp32Snapshot
IsBadReadPtr
GetModuleHandleA
Sleep
WaitForSingleObject
SuspendThread
WriteProcessMemory
ReadProcessMemory
GetLastError
TerminateThread
OpenThread
GetFullPathNameA
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetStdHandle
MoveFileExW
DeleteFileW
GetTimeZoneInformation
CreatePipe
HeapQueryInformation
HeapSize
HeapReAlloc
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetACP
GetFileAttributesExW
GetExitCodeProcess
SetConsoleCtrlHandler
OutputDebugStringW
GetCurrentThread
GetConsoleCP
CreateRemoteThread
TerminateProcess
GetCurrentProcess
OpenProcess
VirtualProtectEx
VirtualFreeEx
VirtualAllocEx
GetProcAddress
ReadConsoleW
GetConsoleMode
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
CreateFileW
SetFilePointerEx
QueryPerformanceFrequency
ExitProcess
GetTempPathW
CreateProcessW
CreateProcessA
DuplicateHandle
FreeLibraryAndExitThread
ResumeThread
GetSystemInfo
HeapValidate
WriteConsoleW
GetModuleHandleExW
GetModuleFileNameW
InterlockedFlushSList
SetEndOfFile
InterlockedPushEntrySList
LoadLibraryExW
DeleteFileA
CreateFileA
CloseHandle
WriteFile
RtlUnwind
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
InitializeSListHead
GetCurrentThreadId
QueryPerformanceCounter
GetStartupInfoW
RaiseException
IsDebuggerPresent
WaitForSingleObjectEx
ResetEvent
SetEvent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ExpandEnvironmentStringsA
FormatMessageW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
InitializeCriticalSection
SleepEx
VerSetConditionMask
VerifyVersionInfoA
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects

user32

SetWindowLongA
MessageBoxA
wsprintfA
GetWindowThreadProcessId
GetClassNameA
EnumWindows
FindWindowA
PostMessageA
GetWindowTextA
GetWindowLongA
SendMessageA

advapi32

LookupPrivilegeValueA
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
AdjustTokenPrivileges
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegEnumValueA
RegDeleteValueA
RegCreateKeyExA
RegCloseKey
OpenProcessToken

shell32

SHCreateDirectoryExA
SHGetSpecialFolderPathA

ws2_32

getsockname
getpeername
connect
closesocket
bind
send
getsockopt
WSASetLastError
select
__WSAFDIsSet
socket
WSAGetLastError
WSACleanup
WSAStartup
htons
ntohs
setsockopt
WSAIoctl
getaddrinfo
freeaddrinfo
accept
recvfrom
sendto
ioctlsocket
gethostname
htonl
ntohl
recv
listen

crypt32

CertFreeCertificateContext

wldap32

ord50
ord60
ord211
ord46
ord143
ord301
ord200
ord41
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22

normaliz

IdnToAscii
IdnToUnicode

psapi

GetModuleFileNameExA

winhttp

WinHttpOpenRequest
WinHttpSetOption
WinHttpConnect
WinHttpQueryHeaders
WinHttpSetTimeouts
WinHttpOpen
WinHttpCloseHandle
WinHttpReadData
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryDataAvailable

Exports

Exports

AcquireDDThreadLock
CompleteCreateSysmemSurface
D3DParseUnknownCommand
DDGetAttachedSurfaceLcl
DDInternalLock
DDInternalUnlock
DSoundHelp
DirectDrawCreate
DirectDrawCreateClipper
DirectDrawCreateEx
DirectDrawEnumerateA
DirectDrawEnumerateExA
DirectDrawEnumerateExW
DirectDrawEnumerateW
DllCanUnloadNow
DllGetClassObject
GetDDSurfaceLocal
GetOLEThunkData
GetSurfaceFromDC
RegisterSpecialCase
ReleaseDDThreadLock
SetAppCompatData

Sections

.textbss
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 414KB - Virtual size: 414KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8e1415dfc7d214222da9615aa0cbbaf6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ws2_32

crypt32

wldap32

normaliz

psapi

winhttp

Exports

Exports

Sections

.textbss Size: - Virtual size: 1.0MB

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 414KB - Virtual size: 414KB

.data Size: 9KB - Virtual size: 17KB

.idata Size: 8KB - Virtual size: 8KB

.gfids Size: 3KB - Virtual size: 3KB

.tls Size: 1024B - Virtual size: 777B

.00cfg Size: 512B - Virtual size: 260B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 80KB - Virtual size: 79KB

.textbss
Size: - Virtual size: 1.0MB

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 414KB - Virtual size: 414KB

.data
Size: 9KB - Virtual size: 17KB

.idata
Size: 8KB - Virtual size: 8KB

.gfids
Size: 3KB - Virtual size: 3KB

.tls
Size: 1024B - Virtual size: 777B

.00cfg
Size: 512B - Virtual size: 260B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 80KB - Virtual size: 79KB