a7ee5140c3f858617a8c1963305ce6a0N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

a7ee5140c3f858617a8c1963305ce6a0N.exe
Size

1.3MB
MD5

a7ee5140c3f858617a8c1963305ce6a0
SHA1

71e9391d8fad05cfda2cc6fa300c422c029354cd
SHA256

1a79b0f6ca6a99926ff9c45d6701f3f0a23a3054f687fcbfa3edf1fd671f8d47
SHA512

c48bb5af46f04a3fbcb8695b82936be44f17ffd4de76a68b063d1c20b5f3333f9b4d2a12e44830878c6d7c87499221cce0f809a45847316002b41bb340db7d87
SSDEEP

12288:LxnnqDlKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LxnqDYsqjnhMgeiCl7G0nehbGZpbD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a7ee5140c3f858617a8c1963305ce6a0N.exe

Files

a7ee5140c3f858617a8c1963305ce6a0N.exe
.exe windows:6 windows x64 arch:x64

73c0949d7bcb5ca0b8af45114ecb12f3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\releases\dva\shared\adobe\mediaio\dvaaudiofilterscan\lib\win\release\64\dvaaudiofilterscan.pdb

Imports

dvacore

?SetClientVersion@config@dvacore@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@@Z
?SetClientInternalVersion@config@dvacore@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@@Z
?SetClientBuildNumber@config@dvacore@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@@Z
?SetCompanyName@config@dvacore@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@@Z
?SetAppIsHeadless@config@dvacore@@YAX_N@Z
?SetSuppressModalDialogs@config@dvacore@@YAX_N@Z
??0ErrorManager@config@dvacore@@QEAA@XZ
??1ErrorManager@config@dvacore@@UEAA@XZ
?Set@ErrorManager@config@dvacore@@SAXPEAV123@@Z
?Instance@DebugDatabase@debug@dvacore@@SAAEAV123@XZ
?SetFileWritesDisabled@DebugDatabase@debug@dvacore@@QEAAX_N@Z
??0Gate@threads@dvacore@@QEAA@_N@Z
??1Gate@threads@dvacore@@QEAA@XZ
?PassThrough@Gate@threads@dvacore@@QEBA_NH@Z
?Open@Gate@threads@dvacore@@QEAAXXZ
?Close@Gate@threads@dvacore@@QEAAXXZ
?RunPlatformEventLoop@threads@dvacore@@YAXXZ
??0MemoryMappedFile@dvacore@@QEAA@XZ
??1MemoryMappedFile@dvacore@@QEAA@XZ
?Open@MemoryMappedFile@dvacore@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_KI@Z
?GetAddress@MemoryMappedFile@dvacore@@QEAAPEAXXZ
?SetParserFactory@xml@dvacore@@YAXAEAV?$deprecated_auto_ptr@VDocParserFactory@xml@dvacore@@@utility@2@@Z
?GetDefaultParserFactory@xml@dvacore@@YA?AV?$deprecated_auto_ptr@VDocParserFactory@xml@dvacore@@@utility@2@XZ
?DecrementLazilyDisplayErrors@ErrorManager@config@dvacore@@UEAAXXZ
?ExecuteFunctionAndConvertException@ErrorManager@config@dvacore@@UEAAHV?$function0@H@boost@@@Z
?IncrementLazilyDisplayErrors@ErrorManager@config@dvacore@@UEAAXXZ
?NewDeferredErrorReporter@ErrorManager@config@dvacore@@UEAA?AV?$intrusive_ptr@VDeferredErrorReporter@config@dvacore@@@boost@@_N@Z
?PurgeMemory@ErrorManager@config@dvacore@@UEAA_N_K@Z
?Recycle@MemoryRecycler@allocator@dvacore@@YAXPEAX_K@Z
?str@?$basic_ostringstream@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@2@XZ
??0oUTF16StringStream@dvacore@@QEAA@XZ
??_DoUTF16StringStream@dvacore@@QEAAXXZ
?Allocate@MemoryRecycler@allocator@dvacore@@YAPEAX_KAEA_K@Z
?AdaptCurrentEventLoopAsExecutor@threads@dvacore@@YA?AV?$shared_ptr@VAsyncEventLoopAdaptor@threads@dvacore@@@boost@@_N@Z
?GetCPUBoundExecutor@threads@dvacore@@YA?AV?$shared_ptr@VAsyncExecutor@threads@dvacore@@@boost@@XZ
?AsyncExecuteTaskOnAllThreads@threads@dvacore@@YA?AV?$shared_ptr@VIMultithreadedTask@threads@dvacore@@@boost@@AEBV?$function@$$A6AXH@Z@4@HAEBV?$shared_ptr@VAsyncExecutor@threads@dvacore@@@4@@Z
?RegisterCurrentThreadAsMainThread@threads@dvacore@@YA?AV?$shared_ptr@VAsyncEventLoopAdaptor@threads@dvacore@@@boost@@XZ
?IsDebuggerAttached@debug@dvacore@@YA_NXZ
?TraceEnabled@debug@dvacore@@YA_NPEBEH_N@Z
?Trace@debug@dvacore@@YAXHAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?SetTraceVolume@debug@dvacore@@YAXPEBEH@Z
?TraceChangeCount@debug@dvacore@@YAHXZ
?SetDisableFileWrites@debug@dvacore@@YAX_N@Z
?SetClientName@config@dvacore@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@@Z
??1File@filesupport@dvacore@@QEAA@XZ
??0File@filesupport@dvacore@@QEAA@AEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@W4StorageType@12@@Z
?AddToObject@serialization@dvacore@@YAXAEAVany@boost@@PEBDV34@_N@Z
?BreakAfterAssertDialog@debug@dvacore@@YA_NAEA_NPEBDPEBE1H1_N@Z
?AsciiToUTF16@string@dvacore@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@PEBD_K@Z
?UTF16to8@string@dvacore@@YA?AV?$basic_string@EU?$char_traits@E@std@@U?$STLAllocator@E@allocator@dvacore@@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@4@@Z
?UTF8to16@string@dvacore@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@AEBV?$basic_string@EU?$char_traits@E@std@@U?$STLAllocator@E@allocator@dvacore@@@4@PEAW4UnicodeErrorCode@12@PEA_K@Z

dvamarshal

??1RPCServer@dvamarshal@@QEAA@XZ
?SendGeneralResult@Responder@dvamarshal@@QEAAXV?$shared_ptr@Vany@boost@@@boost@@@Z
?SendSimpleOK@Responder@dvamarshal@@QEAAXXZ
?SendError@Responder@dvamarshal@@QEAAXHAEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@@Z
?Register@MessageRegistrar@dvamarshal@@QEAAXPEBDV?$shared_ptr@VMessageHandlerBase@dvamarshal@@@boost@@@Z
??0RPCServer@dvamarshal@@QEAA@AEBV?$shared_ptr@VServer@dvatransport@@@boost@@AEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@@Z
?Instance@MessageRegistrar@dvamarshal@@SAPEAV12@XZ

dvatransport

?Create@SocketTransport@dvatransport@@SA?AV?$shared_ptr@VSocketTransport@dvatransport@@@boost@@H@Z
?ServerStart@SocketTransport@dvatransport@@QEAA?AV?$shared_ptr@VServer@SocketTransport@dvatransport@@@boost@@G_N@Z

dvaaudiofilterhost

?SaveConfiguration@PluginModuleInfoManager@dvaaudiofilterhost@@QEBAXAEAVFile@filesupport@dvacore@@_N@Z
?ClearAll@PluginModuleInfoManager@dvaaudiofilterhost@@QEAAX_N@Z
?LoadConfiguration@PluginModuleInfoManager@dvaaudiofilterhost@@QEAAXAEBVFile@filesupport@dvacore@@@Z
?GetInstance@PluginModuleInfoManager@dvaaudiofilterhost@@SAAEAV12@XZ
??0PluginLocator@dvaaudiofilterhost@@QEAA@AEBV01@@Z
??0PluginLocator@dvaaudiofilterhost@@QEAA@XZ
??0PluginModuleScanner@dvaaudiofilterhost@@QEAA@AEBV?$vector@VPluginLocator@dvaaudiofilterhost@@V?$allocator@VPluginLocator@dvaaudiofilterhost@@@std@@@std@@_N11@Z
?GetCurrentProgressInfo@PluginModuleScanner@dvaaudiofilterhost@@QEBA_NAEAVPluginLocator@2@AEAV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@AEAH2@Z
?ContinueScan@PluginModuleScanner@dvaaudiofilterhost@@QEAA_NXZ
?EndScan@PluginModuleScanner@dvaaudiofilterhost@@QEAAXXZ
??1PluginModuleScanner@dvaaudiofilterhost@@UEAA@XZ
?ToString@PluginLocator@dvaaudiofilterhost@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@XZ
?GetInstance@BannedPluginManager@dvaaudiofilterhost@@SAAEAV12@XZ
?Terminate@dvaaudiofilterhost@@YAXXZ
?FromString@PluginLocator@dvaaudiofilterhost@@QEAAXAEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@allocator@dvacore@@@std@@@Z
?Initialize@dvaaudiofilterhost@@YA_N_N@Z
?LoadStaticConfiguration@BannedPluginManager@dvaaudiofilterhost@@QEAA_NAEAVFile@filesupport@dvacore@@@Z
?LoadConfiguration@BannedPluginManager@dvaaudiofilterhost@@QEAAXAEAVFile@filesupport@dvacore@@@Z
??1PluginLocator@dvaaudiofilterhost@@QEAA@XZ

kernel32

GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
FormatMessageA
FormatMessageW
SetErrorMode
WideCharToMultiByte
LocalFree
SetEvent
CloseHandle
OutputDebugStringA
EnterCriticalSection
LeaveCriticalSection
ExitProcess
TlsAlloc
TlsFree
GetLastError

ole32

CoUninitialize
CoInitializeEx

msvcp140

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?uncaught_exception@std@@YA_NXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_J@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

ws2_32

WSACleanup
WSAStartup

vcruntime140

memset
memmove
memcpy
__C_specific_handler
__std_type_info_name
__std_type_info_compare
__std_exception_destroy
__std_exception_copy
__std_terminate
_purecall
_CxxThrowException
__current_exception_context
__current_exception

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
_c_exit
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_register_thread_local_exe_atexit_callback
_set_app_type
exit
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_seh_filter_exe
_invalid_parameter_noinfo_noreturn
_configure_narrow_argv
terminate
strerror

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
_set_new_mode
free

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode
__stdio_common_vsprintf

api-ms-win-crt-string-l1-1-0

strncpy

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.2MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

73c0949d7bcb5ca0b8af45114ecb12f3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

dvacore

dvamarshal

dvatransport

dvaaudiofilterhost

kernel32

ole32

msvcp140

ws2_32

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 87KB - Virtual size: 87KB

.rdata Size: 41KB - Virtual size: 40KB

.data Size: 9KB - Virtual size: 11KB

.pdata Size: 5KB - Virtual size: 5KB

.rsrc Size: 1.2MB - Virtual size: 1.8MB

.text
Size: 87KB - Virtual size: 87KB

.rdata
Size: 41KB - Virtual size: 40KB

.data
Size: 9KB - Virtual size: 11KB

.pdata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 1.2MB - Virtual size: 1.8MB