0a1e40eae0a7024ed91658812e5c1090N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

0a1e40eae0a7024ed91658812e5c1090N.exe
Size

6.8MB
MD5

0a1e40eae0a7024ed91658812e5c1090
SHA1

d15bc20ee2fedba163bf2709480af7400dddf9c5
SHA256

0fb1f0b7ab9005ed7d574c4bc57b1da5298b30186175f632a85a4721e1ed2e26
SHA512

b1631748e4a48e3bee7a2d9b6e34b5492efd9851e8e911988b33ed9cd563fa7727ec64a6cc9bc0f669558293882a9e1b7097ee28783db5327c364f6399438c22
SSDEEP

98304:1nBZeoqpzCxANoun9So2BL3rOajB6ag6/xVtF18H6rRJqPHhbe/:x/hqpzCxANhgoYL7b9/xbr6vc/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a1e40eae0a7024ed91658812e5c1090N.exe

Files

0a1e40eae0a7024ed91658812e5c1090N.exe
.exe windows:5 windows x86 arch:x86

6bdac53e2c2e6722d8c46457a923a8ab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

libcerevoice_aud_shared-5

ord4
ord1
ord14
ord20
ord21

libcerevoice_eng_shared-5

ord51
ord70
ord38

steam_api

SteamAPI_GetHSteamUser
SteamInternal_FindOrCreateUserInterface
SteamAPI_RegisterCallback
SteamAPI_UnregisterCallback
SteamAPI_RegisterCallResult
SteamAPI_UnregisterCallResult
SteamInternal_SteamAPI_Init
SteamInternal_ContextInit

winmm

timeBeginPeriod
timeEndPeriod

ws2_32

closesocket
WSACleanup
shutdown
WSAStartup

dinput8

DirectInput8Create

wininet

InternetGetConnectedState
InternetReadFile
InternetWriteFile
InternetSetOptionA
HttpOpenRequestA
InternetConnectA
InternetOpenA
HttpAddRequestHeadersA
HttpSendRequestA
HttpSendRequestExA
HttpEndRequestA
InternetCloseHandle
HttpQueryInfoA

xinput9_1_0

XInputGetState

opengl32

glBindTexture
glClear
glClearColor
glClearDepth
glCullFace
glDeleteTextures
glDepthFunc
glDepthMask
glDepthRange
glDisable
glDrawArrays
glDrawBuffer
glDrawElements
glEnable
glFrontFace
glGenTextures
glGetError
wglGetProcAddress
glGetTexImage
glPixelStorei
glPolygonOffset
glReadBuffer
glReadPixels
glScissor
glTexImage2D
glTexParameterf
glTexParameteri
glTexSubImage2D
glViewport
wglCreateContext
wglDeleteContext
wglMakeCurrent
glGetIntegerv

kernel32

GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
HeapAlloc
ReadConsoleW
HeapFree
GetConsoleMode
GetConsoleCP
GetACP
WriteFile
GetModuleFileNameA
GetFileType
CreateFileW
GetTempPathW
SetFilePointerEx
ExitThread
GetModuleHandleExW
ReadFile
RtlUnwind
LoadLibraryW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualAlloc
GetVersionExW
GetLogicalProcessorInformation
EnumSystemLocalesW
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
CreateTimerQueue
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
CreateEventW
SetLastError
TryEnterCriticalSection
GetCurrentThread
SwitchToThread
GetCurrentProcess
WaitForSingleObjectEx
DuplicateHandle
LoadLibraryExA
GetModuleHandleW
VirtualQuery
VirtualProtect
FindClose
FindFirstFileA
HeapReAlloc
GetSystemTime
GetEnvironmentVariableA
GetCurrentDirectoryA
CopyFileA
FreeLibrary
GetProcAddress
GetStdHandle
LoadLibraryA
SetCurrentDirectoryA
Sleep
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
TerminateProcess
SetEvent
ResetEvent
WaitForSingleObject
CloseHandle
GetSystemInfo
CreateEventA
GetModuleFileNameW
GetModuleHandleA
OutputDebugStringA
GetWindowsDirectoryA
SetCurrentDirectoryW
CreateDirectoryW
GetFileAttributesW
DeleteFileW
FindFirstFileW
FindNextFileW
QueryPerformanceCounter
QueryPerformanceFrequency
MultiByteToWideChar
WideCharToMultiByte
InitializeCriticalSection
WaitForMultipleObjects
LocalFree
GetLastError
FormatMessageA
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
ExitProcess
lstrlenA
GetTickCount
GetCurrentThreadId
ReleaseMutex
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateMutexA
RaiseException
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
HeapSize
FlushFileBuffers
GetTimeZoneInformation
SetStdHandle
FindFirstFileExA
CreateTimerQueueTimer
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
SetEndOfFile
WriteConsoleW
FindNextFileA
GetThreadTimes
ChangeTimerQueueTimer

user32

DispatchMessageW
TranslateMessage
PostQuitMessage
RegisterClassExW
CreateWindowExW
ShowWindow
SetWindowPos
GetAsyncKeyState
SetCapture
ReleaseCapture
GetSystemMetrics
UpdateWindow
ValidateRect
GetWindowRect
AdjustWindowRectEx
MessageBoxA
ScreenToClient
GetDesktopWindow
LoadCursorA
LoadIconA
LoadImageA
CreateWindowExA
DestroyWindow
ReleaseDC
RegisterClassExA
GetMonitorInfoA
MonitorFromRect
SetWindowLongA
GetWindowLongA
GetClientRect
SetWindowTextW
PeekMessageW
DefWindowProcA
GetDC

gdi32

SetPixelFormat
ChoosePixelFormat
SwapBuffers

comdlg32

GetOpenFileNameA
CommDlgExtendedError

advapi32

RegEnumValueA
RegQueryInfoKeyA
RegOpenKeyExA
RegCloseKey

shell32

ShellExecuteA
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA

ole32

PropVariantClear
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance
CoUninitialize

oleaut32

SysFreeString
SysAllocString

Sections

.text
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 388KB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 545KB - Virtual size: 544KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 211KB - Virtual size: 210KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.bind
Size: 165KB - Virtual size: 165KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6bdac53e2c2e6722d8c46457a923a8ab

Headers

DLL Characteristics

File Characteristics

Imports

libcerevoice_aud_shared-5

libcerevoice_eng_shared-5

steam_api

winmm

ws2_32

dinput8

wininet

xinput9_1_0

opengl32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 4.1MB - Virtual size: 4.1MB

.rdata Size: 1.5MB - Virtual size: 1.5MB

.data Size: 388KB - Virtual size: 1.6MB

_RDATA Size: 2KB - Virtual size: 1KB

.rsrc Size: 545KB - Virtual size: 544KB

.reloc Size: 211KB - Virtual size: 210KB

.bind Size: 165KB - Virtual size: 165KB

.text
Size: 4.1MB - Virtual size: 4.1MB

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 388KB - Virtual size: 1.6MB

_RDATA
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 545KB - Virtual size: 544KB

.reloc
Size: 211KB - Virtual size: 210KB

.bind
Size: 165KB - Virtual size: 165KB