d17b5449e46bf766b8db97d39e2b8e7cc57c2da5d1c399c1770d00998ba3f91f

Sharing

Copy URL Twitter E-mail

General

Target

d17b5449e46bf766b8db97d39e2b8e7cc57c2da5d1c399c1770d00998ba3f91f
Size

1.3MB
MD5

8e0f8e1e8bd6612ca260a497a531ccae
SHA1

2567236c47a316209b5ad80854c572f0b2c933f0
SHA256

d17b5449e46bf766b8db97d39e2b8e7cc57c2da5d1c399c1770d00998ba3f91f
SHA512

76c849cca42baa9e4a3545671897e701787c668192780cd9e7aae6e880ffbe58e026432c65e4cb6bf1321f88068de2e13f29aea340556af58f7717bd48cff3e6
SSDEEP

24576:jpFE9123we4f5NmiBmnNLwexaR8cKR5CkJJFJ3ShcD:jpFE912geo5oiBWNLwex+8ck5Ckb3SyD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d17b5449e46bf766b8db97d39e2b8e7cc57c2da5d1c399c1770d00998ba3f91f

Files

d17b5449e46bf766b8db97d39e2b8e7cc57c2da5d1c399c1770d00998ba3f91f
.exe windows:6 windows x64 arch:x64

db0dab94225fef23692c8e1575f38f1f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\SVN\BTDevManager_Merge\vs2017_BTDevManager\BTDevManager\bin\x64\Win10 Release\RtkBtManServ.pdb

Imports

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
GetLastError
SetErrorMode

api-ms-win-core-heap-l1-1-0

HeapSize
GetProcessHeap
HeapReAlloc
HeapDestroy
HeapAlloc
HeapFree

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
OpenEventW
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
SetEvent
TryEnterCriticalSection
CreateEventW
CreateMutexW
WaitForSingleObject
ReleaseMutex
TryAcquireSRWLockExclusive
ResetEvent
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
Sleep
SleepConditionVariableCS
WakeAllConditionVariable
InitializeConditionVariable

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-processthreads-l1-1-0

ExitThread
CreateThread
TlsSetValue
GetCurrentProcessId
GetCurrentProcess
GetStartupInfoW
TlsGetValue
TerminateProcess
ResumeThread
TlsAlloc
GetCurrentThreadId
GetExitCodeProcess
ExitProcess
OpenProcessToken
SuspendThread
GetCurrentThread
CreateProcessAsUserW
TlsFree

api-ms-win-core-libraryloader-l1-2-0

FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
FindResourceExW
GetProcAddress
LoadResource
GetModuleHandleW
GetModuleHandleExW
SizeofResource
LockResource
FreeLibrary

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
FindResourceW

api-ms-win-security-base-l1-1-0

DuplicateTokenEx
InitializeSecurityDescriptor
AdjustTokenPrivileges
SetTokenInformation
SetSecurityDescriptorDacl

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegEnumValueW
RegSetValueExW
RegQueryInfoKeyW
RegDeleteValueW
RegCloseKey
RegOpenKeyExW
RegNotifyChangeKeyValue
RegCreateKeyExW

api-ms-win-devices-config-l1-1-1

CM_Locate_DevNodeW
CM_Get_Device_Interface_PropertyW
CM_Get_Device_Interface_List_SizeW
CM_Get_Device_Interface_ListW
CM_Get_DevNode_Status
CM_Get_Device_ID_ListW
CM_Get_Device_IDW
CM_Get_Parent
CM_Disable_DevNode
CM_Enable_DevNode
CM_MapCrToWin32Err
CM_Unregister_Notification
CM_Register_Notification
CM_Get_Device_ID_List_SizeW

api-ms-win-core-file-l1-1-0

GetFileType
SetFilePointerEx
GetFileSize
SetEndOfFile
ReadFile
CreateDirectoryW
FindClose
WriteFile
FindFirstFileExW
FindNextFileW
DeleteFileW
CreateFileW
FlushFileBuffers

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime
GetTickCount64
GetVersionExW
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetSystemInfo

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrcmpiW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW
GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W

api-ms-win-service-management-l1-1-0

DeleteService
StartServiceW
CloseServiceHandle
OpenSCManagerW
CreateServiceW
OpenServiceW

api-ms-win-service-winsvc-l1-1-0

ControlService
QueryServiceStatus

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW

ws2_32

WSACleanup
WSAStartup

api-ms-win-shell-shdirectory-l1-1-0

ord290

ext-ms-win-shell32-shellfolders-l1-1-0

SHGetFolderPathW

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-kernel32-legacy-l1-1-0

WTSGetActiveConsoleSessionId

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

api-ms-win-core-toolhelp-l1-1-0

Process32FirstW
CreateToolhelp32Snapshot
Process32NextW

oleaut32

SysAllocStringLen

api-ms-win-core-heap-l2-1-0

GlobalAlloc
LocalAlloc
LocalFree
GlobalFree

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle
ExpandEnvironmentStringsW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetStdHandle
SetEnvironmentVariableW

api-ms-win-core-memory-l1-1-0

ReadProcessMemory

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-io-l1-1-0

GetOverlappedResult
DeviceIoControl

api-ms-win-core-namedpipe-l1-1-0

WaitNamedPipeW

api-ms-win-core-psapi-l1-1-0

K32GetModuleBaseNameW
K32EnumProcesses
K32EnumProcessModules

api-ms-win-core-heap-obsolete-l1-1-0

GlobalHandle
GlobalLock
GlobalUnlock

rpcrt4

RpcStringFreeW
UuidToStringW

ext-ms-win-networking-wlanapi-l1-1-0

WlanQueryInterface
WlanOpenHandle
WlanFreeMemory
WlanCloseHandle
WlanEnumInterfaces

wlanapi

WlanIhvControl

shlwapi

PathRemoveFileSpecW

setupapi

SetupDiEnumDriverInfoW
SetupDiGetDeviceInstallParamsW
SetupDiDestroyDriverInfoList
SetupDiCallClassInstaller
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDriverInfoDetailW
SetupDiSetDeviceInstallParamsW
SetupDiSetClassInstallParamsW
SetupDiEnumDeviceInterfaces
SetupDiOpenDevRegKey
SetupDiBuildDriverInfoList
SetupDiGetClassDevsExW
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo

wtsapi32

WTSQueryUserToken

dbghelp

MiniDumpWriteDump

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW
LCMapStringW
GetCPInfo
FormatMessageW
IsValidCodePage
GetUserDefaultLCID
GetOEMCP
GetACP
EnumSystemLocalesW
IsValidLocale

api-ms-win-core-string-l1-1-0

GetStringTypeW
WideCharToMultiByte
MultiByteToWideChar
CompareStringW

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx
RtlUnwind
RtlPcToFileHeader
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedPushEntrySList
InterlockedFlushSList

api-ms-win-core-fibers-l1-1-0

FlsFree
FlsSetValue
FlsAlloc
FlsGetValue

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-console-l1-1-0

GetConsoleCP
ReadConsoleW
SetConsoleCtrlHandler
GetConsoleMode
WriteConsoleW

Sections

.text
Size: 532KB - Virtual size: 532KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

db0dab94225fef23692c8e1575f38f1f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-util-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-security-base-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-core-l1-1-0

ws2_32

api-ms-win-shell-shdirectory-l1-1-0

ext-ms-win-shell32-shellfolders-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-0

userenv

api-ms-win-core-toolhelp-l1-1-0

oleaut32

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

rpcrt4

ext-ms-win-networking-wlanapi-l1-1-0

wlanapi

shlwapi

setupapi

wtsapi32

dbghelp

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-console-l1-1-0

Sections

.text Size: 532KB - Virtual size: 532KB

.rdata Size: 160KB - Virtual size: 160KB

.data Size: 4KB - Virtual size: 18KB

.pdata Size: 27KB - Virtual size: 27KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 532KB - Virtual size: 532KB

.rdata
Size: 160KB - Virtual size: 160KB

.data
Size: 4KB - Virtual size: 18KB

.pdata
Size: 27KB - Virtual size: 27KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 568KB - Virtual size: 572KB