6b1291a1c07ac8156662015b2d8cccadde0feed334bc590e13a4b4c1bd06d66d

Sharing

Copy URL

Twitter E-mail

General

Target

6b1291a1c07ac8156662015b2d8cccadde0feed334bc590e13a4b4c1bd06d66d
Size

202KB
MD5

f6e5b0fc897c9440943cdac6b9f047f6
SHA1

d5621f9bbe3f8a62fc8407b698ce79e86fd703ee
SHA256

6b1291a1c07ac8156662015b2d8cccadde0feed334bc590e13a4b4c1bd06d66d
SHA512

d168d64883eede54971fdcdbab200101d7f7c59a5fb778a7f01372961828cc665b26cc84ce8d3c320c0b1ccc3fd76a8c04ed2171eeb829f05cc89e40af4d21b2
SSDEEP

3072:56JGVOPz1Q+KK6AMMLBok9YLn+DDXXtURanAqQstHKc5IcFidXOwOvFO++:kJGMb1Q+HlLBokJDD+GDQkNIcFjwe8r

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6b1291a1c07ac8156662015b2d8cccadde0feed334bc590e13a4b4c1bd06d66d

Files

6b1291a1c07ac8156662015b2d8cccadde0feed334bc590e13a4b4c1bd06d66d
.dll windows:6 windows x64 arch:x64

ec6a0f5aac2aff1a4cf69291b0165534

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CreateFileA
GetDriveTypeA
GetLogicalDrives
ReadFile
SetFilePointer
CloseHandle
GetLastError
DeviceIoControl
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
RtlCaptureContext
DisableThreadLibraryCalls
InitializeSListHead
IsDebuggerPresent

shell32

SHGetFolderPathA

vcruntime140

memcpy
memset
strchr
__std_type_info_destroy_list
__C_specific_handler

api-ms-win-crt-heap-l1-1-0

realloc
malloc
free
calloc

api-ms-win-crt-utility-l1-1-0

srand
rand

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf
_open
__stdio_common_vfprintf
__acrt_iob_func
_write
_read
_lseek
_close
_lseeki64
__stdio_common_vsprintf

api-ms-win-crt-string-l1-1-0

strncpy
strtok
isprint
_strnicmp
_stricmp
_strdup
strcmp
isalpha
strncat
strncmp

api-ms-win-crt-time-l1-1-0

_ftime64

api-ms-win-crt-runtime-l1-1-0

abort
strerror
_errno
perror
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_cexit
_initterm

api-ms-win-crt-filesystem-l1-1-0

_stat64i32
_mkdir

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-convert-l1-1-0

atoi

Exports

Exports

AddMD5
DVDClose
DVDCloseFile
DVDDiscID
DVDFileSeek
DVDFileSeekForce
DVDFileSize
DVDFileStat
DVDISOVolumeInfo
DVDOpen
DVDOpen2
DVDOpenFile
DVDOpenStream
DVDOpenStream2
DVDReadBlocks
DVDReadBytes
DVDUDFCacheLevel
DVDUDFVolumeInfo
EndMD5
FreeUDFCache
GetUDFCacheHandle
InitMD5
InternalUDFReadBlocksRaw
SetUDFCacheHandle
UDFFindFile
UDFGetVolumeIdentifier
UDFGetVolumeSetIdentifier
dvdcss_check_device
dvdcss_close
dvdcss_close_device
dvdcss_disckey
dvdcss_error
dvdcss_is_scrambled
dvdcss_open
dvdcss_open_device
dvdcss_open_stream
dvdcss_read
dvdcss_readv
dvdcss_seek
dvdcss_test
dvdcss_title
dvdcss_unscramble
dvdcss_use_ioctls
dvdinput_close
dvdinput_open
dvdinput_read
dvdinput_seek
dvdinput_setup
dvdinput_title
dvdnav_angle_change
dvdnav_audio_language_select
dvdnav_audio_stream_channels
dvdnav_audio_stream_format
dvdnav_audio_stream_to_lang
dvdnav_button_activate
dvdnav_button_activate_cmd
dvdnav_button_select
dvdnav_button_select_and_activate
dvdnav_close
dvdnav_convert_time
dvdnav_current_title_info
dvdnav_current_title_program
dvdnav_describe_title_chapters
dvdnav_dup
dvdnav_err_to_string
dvdnav_free_cache_block
dvdnav_free_dup
dvdnav_get_PGC_positioning_flag
dvdnav_get_active_audio_stream
dvdnav_get_active_spu_stream
dvdnav_get_angle_info
dvdnav_get_audio_attr
dvdnav_get_audio_logical_stream
dvdnav_get_current_highlight
dvdnav_get_current_nav_dsi
dvdnav_get_current_nav_pci
dvdnav_get_current_time
dvdnav_get_disk_region_mask
dvdnav_get_highlight_area
dvdnav_get_next_block
dvdnav_get_next_cache_block
dvdnav_get_next_still_flag
dvdnav_get_number_of_parts
dvdnav_get_number_of_streams
dvdnav_get_number_of_titles
dvdnav_get_position
dvdnav_get_position_in_title
dvdnav_get_readahead_flag
dvdnav_get_region_mask
dvdnav_get_restrictions
dvdnav_get_serial_string
dvdnav_get_spu_attr
dvdnav_get_spu_logical_stream
dvdnav_get_title_string
dvdnav_get_video_aspect
dvdnav_get_video_resolution
dvdnav_get_video_scale_permission
dvdnav_get_volid_string
dvdnav_go_up
dvdnav_is_domain_fp
dvdnav_is_domain_vmgm
dvdnav_is_domain_vts
dvdnav_is_domain_vtsm
dvdnav_jump_to_sector_by_time
dvdnav_left_button_select
dvdnav_lower_button_select
dvdnav_menu_call
dvdnav_menu_language_select
dvdnav_mouse_activate
dvdnav_mouse_select
dvdnav_next_pg_search
dvdnav_open
dvdnav_open2
dvdnav_open_stream
dvdnav_open_stream2
dvdnav_part_play
dvdnav_part_play_auto_stop
dvdnav_part_search
dvdnav_path
dvdnav_pre_cache_blocks
dvdnav_prev_pg_search
dvdnav_program_play
dvdnav_read_cache_block
dvdnav_read_cache_clear
dvdnav_read_cache_free
dvdnav_read_cache_new
dvdnav_reset
dvdnav_right_button_select
dvdnav_sector_search
dvdnav_set_PGC_positioning_flag
dvdnav_set_active_stream
dvdnav_set_readahead_flag
dvdnav_set_region_mask
dvdnav_spu_language_select
dvdnav_spu_stream_to_lang
dvdnav_still_skip
dvdnav_stop
dvdnav_time_play
dvdnav_time_search
dvdnav_title_play
dvdnav_toggle_spu_stream
dvdnav_top_pg_search
dvdnav_upper_button_select
dvdnav_wait_skip
dvdread_getbits
dvdread_getbits_init
dvdread_print_time
get_ID
get_MENU_PGCIT
get_PGCIT
get_PGCN
get_TT
ifoClose
ifoFree_C_ADT
ifoFree_FP_PGC
ifoFree_PGCIT
ifoFree_PGCI_UT
ifoFree_PTL_MAIT
ifoFree_TITLE_C_ADT
ifoFree_TITLE_VOBU_ADMAP
ifoFree_TT_SRPT
ifoFree_TXTDT_MGI
ifoFree_VOBU_ADMAP
ifoFree_VTS_ATRT
ifoFree_VTS_PTT_SRPT
ifoFree_VTS_TMAPT
ifoOpen
ifoOpenNewVTSI
ifoOpenVMGI
ifoOpenVTSI
ifoRead_C_ADT
ifoRead_FP_PGC
ifoRead_PGCIT
ifoRead_PGCI_UT
ifoRead_PTL_MAIT
ifoRead_TITLE_C_ADT
ifoRead_TITLE_VOBU_ADMAP
ifoRead_TT_SRPT
ifoRead_TXTDT_MGI
ifoRead_VOBU_ADMAP
ifoRead_VTS_ATRT
ifoRead_VTS_PTT_SRPT
ifoRead_VTS_TMAPT
ifo_print
ioctl_InvalidateAgid
ioctl_ReadCopyright
ioctl_ReadDiscKey
ioctl_ReadTitleKey
ioctl_ReportASF
ioctl_ReportAgid
ioctl_ReportChallenge
ioctl_ReportKey1
ioctl_ReportRPC
ioctl_SendChallenge
ioctl_SendKey2
navPrint_DSI
navPrint_PCI
navRead_DSI
navRead_PCI
play_Cell
play_Cell_post
play_PG
play_PGC
play_PGC_PG
play_PGC_post
print_debug
print_error
set_FP_PGC
set_MENU
set_PGCN
set_PGN
set_PROG
set_PTT
set_RSMinfo
set_TT
set_VTS_PROG
set_VTS_PTT
set_VTS_TT
vmEval_CMD
vm_exec_cmd
vm_free_copy
vm_free_vm
vm_get_angle_info
vm_get_audio_active_stream
vm_get_audio_attr
vm_get_audio_stream
vm_get_current_menu
vm_get_current_title_part
vm_get_dvd_reader
vm_get_next_cell
vm_get_subp_active_stream
vm_get_subp_attr
vm_get_subp_stream
vm_get_title_ifo
vm_get_video_aspect
vm_get_video_attr
vm_get_video_res
vm_get_video_scale_permission
vm_get_vmgi
vm_get_vtsi
vm_getbits
vm_ifo_close
vm_jump_cell_block
vm_jump_menu
vm_jump_next_pg
vm_jump_pg
vm_jump_prev_pg
vm_jump_resume
vm_jump_title_part
vm_jump_title_program
vm_jump_top_pg
vm_jump_up
vm_merge
vm_new_copy
vm_new_vm
vm_position_get
vm_print_cmd
vm_print_mnemonic
vm_reset
vm_start
vm_stop

Sections

.text
Size: 139KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ec6a0f5aac2aff1a4cf69291b0165534

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shell32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-convert-l1-1-0

Exports

Exports

Sections

.text Size: 139KB - Virtual size: 138KB

.rdata Size: 52KB - Virtual size: 51KB

.data Size: 512B - Virtual size: 3KB

.pdata Size: 8KB - Virtual size: 8KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 116B

.text
Size: 139KB - Virtual size: 138KB

.rdata
Size: 52KB - Virtual size: 51KB

.data
Size: 512B - Virtual size: 3KB

.pdata
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 116B