da3910ac51cc5d01d7bab3da5b4e01fc17889656478e50c3b9c1557f59ca3b26

Sharing

Copy URL

Twitter E-mail

General

Target

da3910ac51cc5d01d7bab3da5b4e01fc17889656478e50c3b9c1557f59ca3b26
Size

911KB
MD5

e2c1060e7c56a00888cd1221efdab197
SHA1

f3ae8d1feaef171f26538833251d3f3e68072db0
SHA256

da3910ac51cc5d01d7bab3da5b4e01fc17889656478e50c3b9c1557f59ca3b26
SHA512

de25a18c876a40f9a5787faf54e6a71360f806612f05b6c05632d87e8d14f9401d4bbbb6cec84c54831816bff10157b6547be0f2981d27b2e5159c3e29144156
SSDEEP

24576:AuxTZtiTj6k5FsR1wliVlcb4bZk61V+c4N/wWdu5UEV8y3GmTxL:h8W4FsrmiDcf61sc4N/pEVv3H9L

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
da3910ac51cc5d01d7bab3da5b4e01fc17889656478e50c3b9c1557f59ca3b26

Files

da3910ac51cc5d01d7bab3da5b4e01fc17889656478e50c3b9c1557f59ca3b26
.dll windows:5 windows x86 arch:x86

9cd91db9d59824e57d37b9309204a964

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\Mabi服务端\客户端插件\MabinogiPath\Release\dsound.pdb

Imports

kernel32

DisableThreadLibraryCalls

user32

MessageBoxW

shell32

CommandLineToArgvW

msvcp140

?_Random_device@std@@YAIXZ

vcruntime140

memcpy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s

api-ms-win-crt-string-l1-1-0

wcscat_s

api-ms-win-crt-runtime-l1-1-0

_crt_atexit

api-ms-win-crt-convert-l1-1-0

wcstoul

api-ms-win-crt-heap-l1-1-0

_callnewh

msvcrt

strncpy

iphlpapi

GetInterfaceInfo

psapi

GetMappedFileNameW

advapi32

RegDeleteKeyA

Exports

Exports

DirectSoundCaptureCreate
DirectSoundCaptureCreate8
DirectSoundCaptureEnumerateA
DirectSoundCaptureEnumerateW
DirectSoundCreate
DirectSoundCreate8
DirectSoundEnumerateA
DirectSoundEnumerateW
DirectSoundFullDuplexCreate
DllCanUnloadNow
DllGetClassObject
GetDeviceID

Sections

.text
Size: 63KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 839KB - Virtual size: 840KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9cd91db9d59824e57d37b9309204a964

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

msvcp140

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

msvcrt

iphlpapi

psapi

advapi32

Exports

Exports

Sections

.text Size: 63KB - Virtual size: 220KB

.rdata Size: 839KB - Virtual size: 840KB

.idata Size: 1024B - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 4KB

.reloc Size: 1024B - Virtual size: 4KB

.rdata Size: 4KB - Virtual size: 4KB

.text
Size: 63KB - Virtual size: 220KB

.rdata
Size: 839KB - Virtual size: 840KB

.idata
Size: 1024B - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 4KB

.reloc
Size: 1024B - Virtual size: 4KB

.rdata
Size: 4KB - Virtual size: 4KB