8efb29b9232946dad82b826d89616295518db4a076e3d26132ba2b8a253536a1

Sharing

Copy URL Twitter E-mail

General

Target

8efb29b9232946dad82b826d89616295518db4a076e3d26132ba2b8a253536a1
Size

2.4MB
MD5

5f01ff349a42bc92772d30bf280dbe40
SHA1

48ce830caba67adfeb05f38689b4c424fd54cf55
SHA256

8efb29b9232946dad82b826d89616295518db4a076e3d26132ba2b8a253536a1
SHA512

e3e2bf5b38635cd0eb6a82e0292c7e3b9d6c0b48a24891ce305f9117d4d57fb8684eefcadaa35e81f53d718e6f1f650ecc982ae2f9792c47f6403fe7e5091aef
SSDEEP

49152:hDIFC+jKhGtCpdGE9nl24fshBfdNKiYFzd+LTKrCm87wq:hvrbGcnl28shBfdNKiY9dY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8efb29b9232946dad82b826d89616295518db4a076e3d26132ba2b8a253536a1

Files

8efb29b9232946dad82b826d89616295518db4a076e3d26132ba2b8a253536a1
.exe windows:5 windows x86 arch:x86

aca1d9d89bc590b3cb479f30204614b6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetProcessHeap
SetEndOfFile
WideCharToMultiByte
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeA
GetLocaleInfoA
SetFilePointer
ReadFile
CreateFileW
CreateFileA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
CloseHandle
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
Sleep
MultiByteToWideChar
GetCurrentProcess
GetLongPathNameW
MulDiv
SleepEx
SwitchToThread
FormatMessageA
GetLastError
LocalFree
FindFirstFileW
FindNextFileW
FindClose
CreateDirectoryA
CreateDirectoryW
GetSystemTimeAsFileTime
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
HeapFree
GetTimeFormatA
GetDateFormatA
GetStartupInfoW
HeapAlloc
GetModuleHandleW
GetProcAddress
ExitProcess
MoveFileA
DeleteFileW
MoveFileW
HeapReAlloc
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapCreate
VirtualFree
VirtualAlloc
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
HeapSize
WriteFile
GetStdHandle
GetModuleFileNameA
GetTimeZoneInformation
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
DeleteFileA

user32

DrawTextA
SetWindowTextW
MessageBoxA
GetCursor
MessageBoxW
GetCursorPos
GetKeyboardLayout
DrawTextW
DestroyIcon
SetCursor
CreateWindowExW
RegisterClassExW
GetWindowLongW
SystemParametersInfoW
ShowWindow
UpdateWindow
SetActiveWindow
SendMessageW
SetForegroundWindow
SetWindowLongW
SetWindowPos
AdjustWindowRect
GetWindowInfo
GetDC
GetClientRect
ReleaseDC
DefWindowProcW
IsIconic
PostQuitMessage
FindWindowW
DestroyWindow
UnregisterClassW
PeekMessageW
TranslateMessage
DispatchMessageW
LoadIconW
LoadCursorW

squall

SQUALL_Channel_Pause
SQUALL_Channel_Start
SQUALL_Channel_SetVolume
SQUALL_Channel_GetVolume
SQUALL_Init
SQUALL_Channel_Status
SQUALL_SetFileCallbacks
SQUALL_Listener_EAX_SetPreset
SQUALL_Stop
SQUALL_Sample_LoadFile
SQUALL_Sample_Unload
SQUALL_ChannelGroup_SetVolume
SQUALL_Pause
SQUALL_Sample_PlayEx
SQUALL_Sample_GetFileFrequency
SQUALL_Channel_Stop
SQUALL_Free

jngload

?freeData@@YAXAAPAK@Z
?readMNG@@YAXPBXAAK1AAPAK@Z

d3d8

Direct3DCreate8

pyro

??1CPyroException@PyroParticles@@QAE@XZ
?DestroyParticleLibrary@@YAXPAVIPyroParticleLibrary@PyroParticles@@@Z
?CreateParticleLibrary@@YAPAVIPyroParticleLibrary@PyroParticles@@I@Z
??0CPyroException@PyroParticles@@QAE@PAD@Z
??0CPyroException@PyroParticles@@QAE@ABV01@@Z

shlwapi

PathFindFileNameW

psapi

EnumProcessModules
GetModuleFileNameExW

winmm

timeBeginPeriod
timeGetTime
timeEndPeriod

dinput8

DirectInput8Create

ws2_32

inet_addr
socket
WSAGetLastError
closesocket
connect
ioctlsocket
recv
select
__WSAFDIsSet
send
setsockopt
htons

gdi32

CreateFontW
DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
CreateDIBSection
SetBkMode
CreateFontIndirectA
GetObjectA
DeleteDC
SetBkColor
SetTextColor
GetTextExtentPoint32W
CreateFontIndirectW
GetDeviceCaps
CreateSolidBrush
GetDIBits
BitBlt

advapi32

RegCloseKey
RegQueryValueExA
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExA

shell32

SHGetFolderPathW

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 245KB - Virtual size: 245KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 470KB - Virtual size: 469KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aca1d9d89bc590b3cb479f30204614b6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

squall

jngload

d3d8

pyro

shlwapi

psapi

winmm

dinput8

ws2_32

gdi32

advapi32

shell32

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 245KB - Virtual size: 245KB

.data Size: 56KB - Virtual size: 72KB

.rsrc Size: 470KB - Virtual size: 469KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 245KB - Virtual size: 245KB

.data
Size: 56KB - Virtual size: 72KB

.rsrc
Size: 470KB - Virtual size: 469KB