1bfc66e81391ee8030fa50c6f8d22c40N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

1bfc66e81391ee8030fa50c6f8d22c40N.exe
Size

1.7MB
MD5

1bfc66e81391ee8030fa50c6f8d22c40
SHA1

ae0216ddff6c02b95b917e9960c811fbe3a1f1b4
SHA256

f7cf4a97c883f8f3d2f656600f27cd4bcca4292848efa0f592942d2629213879
SHA512

e10c6b7a433992a1adc11de251318a16e6230dfe423456d431c6e8a88ef6bdd781f35362c05ce4244f2ed5d72985f871c2fdb1cfa0084c639d2557418949f42f
SSDEEP

12288:HdqHZ44YUoGf+bwSMBW/07psFcCPFMyVuOqbatLu:UHZVYUoGf8wJBW87psdPgba0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1bfc66e81391ee8030fa50c6f8d22c40N.exe

Files

1bfc66e81391ee8030fa50c6f8d22c40N.exe
.dll windows:10 windows x86 arch:x86

f0839c4846f7a7ffed88d1d96eb12022

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

rdvgogl32.pdb

Imports

msvcrt

islower
calloc
isupper
__pctype_func
abort
??1type_info@@UAE@XZ
__CxxFrameHandler3
?terminate@@YAXXZ
_free_locale
_get_current_locale
__crtLCMapStringA
__crtLCMapStringW
__crtCompareStringA
__crtCompareStringW
_wcsdup
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
localeconv
??0bad_cast@@QAE@PBD@Z
_onexit
__dllonexit
strcspn
ldexp
realloc
_initterm
_amsg_exit
_XcptFilter
_unlock
isdigit
_lock
_Getdays
isalnum
memcmp
___lc_collate_cp_func
memchr
tolower
isspace
memset
_Strftime
_ismbblead
___lc_codepage_func
___lc_handle_func
___mb_cur_max_func
_errno
memmove
memcpy
_CxxThrowException
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@XZ
_callnewh
sscanf_s
_aligned_malloc
_aligned_free
_vsnwprintf
??_V@YAXPAX@Z
strtok_s
sprintf_s
malloc
free
__mb_cur_max
_Gettnames
_Wcsftime
??0exception@@QAE@ABQBD@Z
_ftol2_sse
_ftol2
_CIsin
setlocale
_except_handler4_common
_W_Gettnames
_W_Getmonths
_W_Getdays
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
memcpy_s
_purecall
??3@YAXPAX@Z
_Getmonths
_CIcos
ceil

advapi32

GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage

user32

UnhookWindowsHookEx
SetPropW
AdjustWindowRect
GetWindowInfo
GetClientRect
CallNextHookEx
ReleaseDC
GetDC
MessageBoxW
LoadStringW
WindowFromDC
EnumDisplayDevicesW
SetWindowsHookExW

kernel32

GetStringTypeW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
DecodePointer
EncodePointer
GetCurrentProcessId
InitializeCriticalSectionEx
WideCharToMultiByte
MultiByteToWideChar
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
VirtualFree
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
Sleep
GetModuleFileNameW
SetUnhandledExceptionFilter
GetLocaleInfoW
GetSystemInfo
TlsSetValue
GetWriteWatch
ResetWriteWatch
GetCurrentThreadId
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
TlsAlloc
TlsFree
GetLastError
GetModuleHandleW
GetProcAddress
ResolveDelayLoadedAPI
DelayLoadFailureHook
TlsGetValue
VirtualAlloc

gdi32

SetPixelFormat
DeleteDC
CreateCompatibleDC
ChoosePixelFormat
CreateDCW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

ntdll

RtlIsCriticalSectionLockedByThread

d3d11

D3D11CreateDevice

opengl32

glGetTexLevelParameteriv
wglCreateContext

glu32

gluErrorString

rfxvmt

RfxVmtCloseChannel
RfxVmtReadChannel
RfxVmtWriteChannel
RfxVmtGetDataAvailableEvent
RfxVmtCreateChannel

Exports

Exports

DllMain
DrvCopyContext
DrvCreateContext
DrvCreateLayerContext
DrvDeleteContext
DrvDescribeLayerPlane
DrvDescribePixelFormat
DrvGetLayerPaletteEntries
DrvGetProcAddress
DrvPresentBuffers
DrvRealizeLayerPalette
DrvReleaseContext
DrvSetCallbackProcs
DrvSetContext
DrvSetLayerPaletteEntries
DrvSetPixelFormat
DrvShareLists
DrvSwapBuffers
DrvSwapLayerBuffers
DrvSwapMultipleBuffers
DrvValidateVersion

Sections

.text
Size: 623KB - Virtual size: 622KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 169KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f0839c4846f7a7ffed88d1d96eb12022

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

user32

kernel32

gdi32

version

ntdll

d3d11

opengl32

glu32

rfxvmt

Exports

Exports

Sections

.text Size: 623KB - Virtual size: 622KB

.data Size: 2KB - Virtual size: 3KB

.idata Size: 4KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 8B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 169KB - Virtual size: 169KB

.text
Size: 623KB - Virtual size: 622KB

.data
Size: 2KB - Virtual size: 3KB

.idata
Size: 4KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 169KB - Virtual size: 169KB