f9d6d81c1667d29d034ca413a9fb1210N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

f9d6d81c1667d29d034ca413a9fb1210N.exe
Size

802KB
MD5

f9d6d81c1667d29d034ca413a9fb1210
SHA1

30cb8e3dc8bd189e619b60c557cbdbee85d26762
SHA256

10aee3bee89557f1cba6074ad509405c35d3b3d833bfe2671351ecdae47437e9
SHA512

8d1af7a051d4e6fc37f724d9ae74ecfa051862f8e22bbc9eb2869be885e98e111838a74281358592309b9c0ada0f7a0086adb85322fe25745c8db18517380583
SSDEEP

12288:zdqHZ44YUoGf+bwSMzW80/psFcCPFMyVuOq55qt0t:AHZVYUoGf8wJzWb/psdPgLqta

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f9d6d81c1667d29d034ca413a9fb1210N.exe

Files

f9d6d81c1667d29d034ca413a9fb1210N.exe
.dll windows:10 windows x86 arch:x86

f0839c4846f7a7ffed88d1d96eb12022

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

rdvgogl32.pdb

Imports

msvcrt

islower
calloc
isupper
__pctype_func
abort
??1type_info@@UAE@XZ
__CxxFrameHandler3
?terminate@@YAXXZ
_free_locale
_get_current_locale
__crtLCMapStringA
__crtLCMapStringW
__crtCompareStringA
__crtCompareStringW
_wcsdup
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
localeconv
??0bad_cast@@QAE@PBD@Z
_onexit
__dllonexit
strcspn
ldexp
realloc
_initterm
_amsg_exit
_XcptFilter
_unlock
isdigit
_lock
_Getdays
isalnum
memcmp
___lc_collate_cp_func
memchr
tolower
isspace
memset
_Strftime
_ismbblead
___lc_codepage_func
___lc_handle_func
___mb_cur_max_func
_errno
memmove
memcpy
_CxxThrowException
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@XZ
_callnewh
sscanf_s
_aligned_malloc
_aligned_free
_vsnwprintf
??_V@YAXPAX@Z
strtok_s
sprintf_s
malloc
free
__mb_cur_max
_Gettnames
_Wcsftime
??0exception@@QAE@ABQBD@Z
_ftol2_sse
_ftol2
_CIsin
setlocale
_except_handler4_common
_W_Gettnames
_W_Getmonths
_W_Getdays
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
memcpy_s
_purecall
??3@YAXPAX@Z
_Getmonths
_CIcos
ceil

advapi32

GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage

user32

UnhookWindowsHookEx
SetPropW
AdjustWindowRect
GetWindowInfo
GetClientRect
CallNextHookEx
ReleaseDC
GetDC
MessageBoxW
LoadStringW
WindowFromDC
EnumDisplayDevicesW
SetWindowsHookExW

kernel32

GetStringTypeW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
DecodePointer
EncodePointer
GetCurrentProcessId
InitializeCriticalSectionEx
WideCharToMultiByte
MultiByteToWideChar
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
VirtualFree
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
Sleep
GetModuleFileNameW
SetUnhandledExceptionFilter
GetLocaleInfoW
GetSystemInfo
TlsSetValue
GetWriteWatch
ResetWriteWatch
GetCurrentThreadId
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
TlsAlloc
TlsFree
GetLastError
GetModuleHandleW
GetProcAddress
ResolveDelayLoadedAPI
DelayLoadFailureHook
TlsGetValue
VirtualAlloc

gdi32

SetPixelFormat
DeleteDC
CreateCompatibleDC
ChoosePixelFormat
CreateDCW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

ntdll

RtlIsCriticalSectionLockedByThread

d3d11

D3D11CreateDevice

opengl32

glGetTexLevelParameteriv
wglCreateContext

glu32

gluErrorString

rfxvmt

RfxVmtCloseChannel
RfxVmtReadChannel
RfxVmtWriteChannel
RfxVmtGetDataAvailableEvent
RfxVmtCreateChannel

Exports

Exports

DllMain
DrvCopyContext
DrvCreateContext
DrvCreateLayerContext
DrvDeleteContext
DrvDescribeLayerPlane
DrvDescribePixelFormat
DrvGetLayerPaletteEntries
DrvGetProcAddress
DrvPresentBuffers
DrvRealizeLayerPalette
DrvReleaseContext
DrvSetCallbackProcs
DrvSetContext
DrvSetLayerPaletteEntries
DrvSetPixelFormat
DrvShareLists
DrvSwapBuffers
DrvSwapLayerBuffers
DrvSwapMultipleBuffers
DrvValidateVersion

Sections

.text
Size: 623KB - Virtual size: 622KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 169KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f0839c4846f7a7ffed88d1d96eb12022

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

user32

kernel32

gdi32

version

ntdll

d3d11

opengl32

glu32

rfxvmt

Exports

Exports

Sections

.text Size: 623KB - Virtual size: 622KB

.data Size: 2KB - Virtual size: 3KB

.idata Size: 4KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 8B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 169KB - Virtual size: 169KB

.text
Size: 623KB - Virtual size: 622KB

.data
Size: 2KB - Virtual size: 3KB

.idata
Size: 4KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 169KB - Virtual size: 169KB