68a8a50f98e85114bd2a568bf82470691ec2343d25d680fc70ca0f6f16fba618

Sharing

Copy URL Twitter E-mail

General

Target

68a8a50f98e85114bd2a568bf82470691ec2343d25d680fc70ca0f6f16fba618
Size

164KB
MD5

29ad5267d89ec9150bfb3193e75efe14
SHA1

54cdb352823950f6fca1c75eb488f4deeb52da87
SHA256

68a8a50f98e85114bd2a568bf82470691ec2343d25d680fc70ca0f6f16fba618
SHA512

c2b7476217c39c953fffdece57df1d61a67a288786fc98fe76360e241e7f7d2cfd749477303708bbad3e260806a051fb80cd95b7eb6e4c8e951ab7e7fd4f4e4f
SSDEEP

3072:l2tpw9BLuCI454mLQC2mCadVIvaQ7hqH3sLYNR0X7X9PkXPx3VBJgp7T:luG/I4y+VAaQhssLYsLCh2T

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
68a8a50f98e85114bd2a568bf82470691ec2343d25d680fc70ca0f6f16fba618

Files

68a8a50f98e85114bd2a568bf82470691ec2343d25d680fc70ca0f6f16fba618
.dll windows:6 windows x86 arch:x86

1b2210852e56b4a472527a4c6f8174bc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\a\Sky\SP\Bin\Bin_GameServer\SPGameServer32.pdb

Imports

kernel32

GetModuleFileNameA
WideCharToMultiByte
MultiByteToWideChar
GetNativeSystemInfo
CreateFileA
GetFileSize
ReadFile
CloseHandle
OutputDebugStringW
LocalFree
HeapAlloc
HeapFree
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
HeapCreate
HeapDestroy
Sleep
SwitchToThread
LeaveCriticalSection
EnterCriticalSection
SetLastError
WaitForSingleObject
GetLastError
GetCurrentThreadId
lstrlenA
GetProcAddress
GetModuleHandleA
MapViewOfFileEx
CreateFileMappingA
ResetEvent
SetEvent
UnmapViewOfFile
HeapSize
HeapReAlloc
GetProcessHeap
CreateEventA
InitializeCriticalSectionEx
RaiseException
DecodePointer
GetPrivateProfileIntA
GetPrivateProfileStringA
SetEndOfFile
WriteConsoleW
SetFilePointerEx
SetStdHandle
FlushFileBuffers
CreateFileW
LocalAlloc
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
GetStringTypeW
GetTimeZoneInformation
CreateDirectoryW
GetFileAttributesExW
GetConsoleMode
GetConsoleCP
WriteFile
GetACP
ReadConsoleW
GetFileType
GetStdHandle
LCMapStringW
CompareStringW
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
RtlUnwind
InterlockedFlushSList
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
TlsAlloc

user32

MessageBoxA

shlwapi

StrChrA

ws2_32

WSACleanup
WSAStartup
closesocket
shutdown
WSAIoctl
socket
getsockname
WSAGetLastError
inet_ntop
ntohs
freeaddrinfo
getaddrinfo
htons
WSAStringToAddressW
WSASetLastError
WSACreateEvent
bind
WSAEventSelect
connect
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
WSAResetEvent
recv
send
WSACloseEvent

Exports

Exports

SP_Login
SP_Logout

Sections

.text
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1b2210852e56b4a472527a4c6f8174bc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shlwapi

ws2_32

Exports

Exports

Sections

.text Size: 118KB - Virtual size: 118KB

.rdata Size: 32KB - Virtual size: 32KB

.data Size: 3KB - Virtual size: 6KB

.gfids Size: 512B - Virtual size: 244B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 118KB - Virtual size: 118KB

.rdata
Size: 32KB - Virtual size: 32KB

.data
Size: 3KB - Virtual size: 6KB

.gfids
Size: 512B - Virtual size: 244B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 6KB