0be0e513042b41adffb3e3144315a00f709c70278bcf16cfce704745777eef8b

Sharing

Copy URL

Twitter E-mail

General

Target

0be0e513042b41adffb3e3144315a00f709c70278bcf16cfce704745777eef8b
Size

582KB
MD5

e5fb32b4ef52c0131c7001f57e0d05e5
SHA1

6bd8b36c52983f2842f64f4ea729a374088e0ebf
SHA256

0be0e513042b41adffb3e3144315a00f709c70278bcf16cfce704745777eef8b
SHA512

ffda380e73d73dbe0fcbed9a46bc37dcd847c5843b577addf84dc58d3aa4dbc5cc5fc71848cc5fe73b0d1a406fbe177db4993d001b86f87bc56c306f25c8e16a
SSDEEP

12288:bYSIuuCfZ7nmlydisrTBq7fEpC2qhoO5lrR:EOFZ7nMKq7fEJqhvll

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0be0e513042b41adffb3e3144315a00f709c70278bcf16cfce704745777eef8b

Files

0be0e513042b41adffb3e3144315a00f709c70278bcf16cfce704745777eef8b
.exe windows:6 windows x64 arch:x64

4d354e68db58c8fd037f94a8e5faff2a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\develope\ScreencastV6\x64\Release\hwcodecinfo.pdb

Imports

kernel32

VerSetConditionMask
IsDebuggerPresent
Sleep
SizeofResource
HeapFree
InitializeCriticalSectionEx
HeapSize
LockResource
HeapReAlloc
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
DecodePointer
HeapDestroy
DeleteCriticalSection
GetProcessHeap
WideCharToMultiByte
GetModuleFileNameA
WriteFile
GetLocalTime
DebugBreak
EnterCriticalSection
LeaveCriticalSection
SetEvent
VerifyVersionInfoW
FreeLibrary
QueryPerformanceCounter
LoadLibraryExW
GetModuleFileNameW
SwitchToThread
SetThreadErrorMode
GetModuleHandleExW
GetModuleHandleW
FindFirstFileW
GetFullPathNameW
FindNextFileW
GetEnvironmentVariableW
GetEnvironmentVariableA
FindClose
GetCurrentDirectoryW
MultiByteToWideChar
SetErrorMode
MapViewOfFileEx
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
K32GetProcessMemoryInfo
GetCurrentThread
K32GetMappedFileNameW
SetUnhandledExceptionFilter
VirtualQuery
VirtualProtect
GetSystemInfo
WriteConsoleW
SetEndOfFile
CreateFileW
GetProcAddress
LoadLibraryW
CreateEventW
CloseHandle
ResetEvent
GetLastError
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
FindFirstFileExW
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
LoadLibraryExA
SetFilePointerEx
GetFileSizeEx
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetOEMCP
GetACP
IsValidCodePage
GetFileType
GetStdHandle
GetCommandLineW
GetCommandLineA
ExitProcess
RtlUnwind
OutputDebugStringW
RaiseException
GetStringTypeW
LCMapStringEx
EncodePointer
CompareStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree

user32

MessageBoxW

advapi32

RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW

ole32

CoInitializeEx
CoTaskMemFree
CoTaskMemAlloc
StringFromGUID2

shlwapi

StrCmpNW

mfplat

MFShutdown
MFStartup
MFTEnumEx

dbghelp

SymGetLineFromAddr64
SymFunctionTableAccess64
StackWalk64
SymFromAddr
SymGetModuleBase64

Sections

.text
Size: 372KB - Virtual size: 371KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 314KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4d354e68db58c8fd037f94a8e5faff2a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

shlwapi

mfplat

dbghelp

Sections

.text Size: 372KB - Virtual size: 371KB

.rdata Size: 164KB - Virtual size: 164KB

.data Size: 16KB - Virtual size: 314KB

.pdata Size: 17KB - Virtual size: 17KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 372KB - Virtual size: 371KB

.rdata
Size: 164KB - Virtual size: 164KB

.data
Size: 16KB - Virtual size: 314KB

.pdata
Size: 17KB - Virtual size: 17KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 4KB - Virtual size: 3KB