975ca56142eb4b41aa2ed6a9c83566a3f019181c18d9f8e837190649fa537edb

Sharing

Copy URL Twitter E-mail

General

Target

975ca56142eb4b41aa2ed6a9c83566a3f019181c18d9f8e837190649fa537edb
Size

6.6MB
MD5

14f1522ed1f1a3522556c2874a3b8d2b
SHA1

c8147bdfc107521da626a6044dba4a9f3f16bdf2
SHA256

975ca56142eb4b41aa2ed6a9c83566a3f019181c18d9f8e837190649fa537edb
SHA512

e5890ff0888f9bcb5ce598f3a66d2e919a7e7dbbfdab84862ae00f91483b64bd2a74176b65cb3f4a9372d32c1112b12d87d595f673f53d1ae71e472fd8fc173d
SSDEEP

196608:RrDQ/HbklvNUwGhlKaufdB5YC1GUVpTb:xKOsloxVVb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
975ca56142eb4b41aa2ed6a9c83566a3f019181c18d9f8e837190649fa537edb

Files

975ca56142eb4b41aa2ed6a9c83566a3f019181c18d9f8e837190649fa537edb
.exe windows:6 windows x86 arch:x86

89e04b8eeb162420e348a8a094ca126d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

avcodec-58

av_packet_alloc
av_packet_free
av_packet_rescale_ts
av_packet_unref
av_parser_close
av_parser_init
av_parser_parse2
avcodec_alloc_context3
avcodec_find_decoder
avcodec_find_encoder_by_name
avcodec_free_context
avcodec_open2
avcodec_parameters_from_context
avcodec_receive_frame
avcodec_receive_packet
avcodec_send_frame
avcodec_send_packet

avformat-58

av_dump_format
av_interleaved_write_frame
av_read_frame
av_write_trailer
avformat_alloc_output_context2
avformat_close_input
avformat_find_stream_info
avformat_free_context
avformat_new_stream
avformat_open_input
avformat_write_header
avio_closep
avio_open

avutil-56

av_dict_set
av_dict_set_int
av_frame_alloc
av_frame_free
av_freep
av_image_alloc
av_log_default_callback
av_log_set_callback
av_log_set_level

swresample-3

swr_free

swscale-5

sws_freeContext
sws_getContext
sws_scale

kernel32

GetCurrentProcess
ResetEvent
CreateThread
SetEvent
CreateEventW
OutputDebugStringA
WideCharToMultiByte
GetCurrentProcessId
GetConsoleMode
Sleep
GetFileAttributesW
LocalFree
FormatMessageA
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
GetModuleHandleW
WaitForSingleObjectEx
IsProcessorFeaturePresent
TerminateProcess
GetCommandLineW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetDynamicTimeZoneInformation
WriteFile
WriteConsoleA
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
PostQueuedCompletionStatus
GetLastError
TlsAlloc
TlsFree
MultiByteToWideChar
LoadLibraryA
GetProcAddress
FreeLibrary
SetWaitableTimer
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
GetQueuedCompletionStatus
WaitForSingleObject
TerminateThread
CloseHandle
QueueUserAPC
DeleteCriticalSection
VerSetConditionMask
VerifyVersionInfoW
CreateIoCompletionPort
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetStdHandle
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
LoadLibraryA
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
WriteConsoleW
SetStdHandle
IsProcessorFeaturePresent
DecodePointer
GetCommandLineA
RaiseException
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringW
GetStringTypeW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapSize
WriteFile
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

shell32

CommandLineToArgvW

msvcp140

_Thrd_join
_Mtx_init
_Cnd_init
_Mtx_destroy
?_Xlength_error@std@@YAXPBD@Z
_Mbrtowc
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$numpunct@D@std@@2V0locale@2@A
?_Throw_C_error@std@@YAXH@Z
?_Syserror_map@std@@YAPBDH@Z
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Xtime_get_ticks
_Mtx_unlock
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
_Query_perf_frequency
_Query_perf_counter
_Thrd_sleep
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
_Cnd_init_in_situ
?setiosflags@std@@YA?AU?$_Smanip@H@1@H@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
_Cnd_broadcast
_Cnd_destroy_in_situ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
_Cnd_signal
_Mtx_current_owns
?_Throw_Cpp_error@std@@YAXH@Z
?id@?$numpunct@_W@std@@2V0locale@2@A
_Cnd_timedwait
_Cnd_do_broadcast_at_thread_exit
_Cnd_destroy
_Cnd_wait
_Thrd_id
_Thrd_start

ws2_32

WSAStringToAddressW
WSASetLastError
ntohl
select
WSASend
closesocket
WSAStartup
connect
WSARecv
getsockopt
htonl
htons
ioctlsocket
setsockopt
WSAGetLastError
WSACleanup
WSASocketW

vcruntime140

memcpy
__RTDynamicCast
memchr
memmove
_CxxThrowException
memset
_except_handler4_common
strrchr
__std_type_info_compare
__std_exception_copy
__std_exception_destroy
_purecall
__std_terminate
__CxxFrameHandler3

api-ms-win-crt-stdio-l1-1-0

_wfsopen
__p__commode
fflush
__stdio_common_vsprintf_s
__stdio_common_vfprintf
__stdio_common_vsnprintf_s
fclose
_filelength
__acrt_iob_func
_setmode
_fileno
fwrite
feof
__stdio_common_vsprintf
fopen_s
_set_fmode
_fseeki64
fread
_ftelli64

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
_controlfp_s
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_invalid_parameter_noinfo_noreturn
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_register_thread_local_exe_atexit_callback
terminate
_errno
_c_exit
strerror
strerror_s

api-ms-win-crt-heap-l1-1-0

realloc
calloc
malloc
_callnewh
_set_new_mode
free

api-ms-win-crt-string-l1-1-0

isdigit
isprint

api-ms-win-crt-math-l1-1-0

_fdsign
_dtest
__setusermatherr
_fdtest
_dsign
_ldtest
_ldsign
_except1

api-ms-win-crt-time-l1-1-0

_gmtime64_s
strftime
_localtime64_s

api-ms-win-crt-filesystem-l1-1-0

_wremove
_wrename
_wmkdir

api-ms-win-crt-convert-l1-1-0

_strtoi64
_wcstoi64
atoi

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

user32

CharUpperBuffW

Exports

Exports

CreateCdmInstance
DeinitializeCdmModule
GetCdmVersion
InitializeCdmModule_4
�$��.�Qmvh�q<p8�'!'�O��zs��kfW�>a�O�_��Jݮ�IRG�l�fwuz�D�D�L�� D�\��(O��=��8��ľI��aV�W��ll��{�Q��:��`��cLhת�F<��km=�6�kH�õ�z��T��|`Mx,�_�=#��Ӿ��}�iTq�U�"�z��^�d��q�'B|��bٓ%[�iC��R��^OQ�W�+74��e��h� �4��D�t;k:�8��j/Xw��&^7�.�g?��b��[R�᠙�$�T�v��mK|j�[��U��$e�ݥ�&�J}��8��6n[EW�U��%�`'��;2�"SD�0��ruOu�ͽ��C�"��,N)(��ȍ�ם��2�04��Ц��^� �Bb>[a��+�� ]p��c�>ՙ�ǚ�ԃ�\�c��d�e��xGJ��^��Q�%LN�w�� H7c��_�� u��1�9��n=?�u!��c��}�W'M��x8�i��T�w��دU"!_k��+?ԙ��C��Hh��_%�v��i�o?�]�xjR��UB'��-��ˊ��1�8��%��[j�rD�2��v��Πx��N��}�3`��W;�Un�`#z�GB4��7�;u]`o�*�,p~�z^��j�q�x~U�Ƒy�(�۹��T͡;sM�� >��I�D��=6��7��n�,�|h��3t��R�^�*�%��"��h).ʱ;��ls��D��H��Q�>_oPҹC��,d�K��5pѝ�x�㟻�!�.��7t�0��hZG�)��5ݢ�'Y1-�b�}��-��V�r��*��{P��Y=��M ��r�`��kR� {t��Ԉ��--��J�e�ƏvN�#Y�&]>��\��ɼ�P`��<�d�\��V)�zq��˛�lo!w��o��0��k��q�5!��e�0]��`�qfK��'�} 8�]'r�Ҳڽ3-�/��ZNS9�~�m-oz��%��}�K�4�B_��T��9��P�#�2-��9Ƀ ̌�.+A�}|��KR5:��D6��8vfS��Y��{�d�su��#'�=<-%d�^� �d��yG ��sz��(%�Y�{sG��lXv�V�5k@L�[D(��,�8p��[��[��>��0�s�i�,g�Y@M�S[$�_4MG��z��G,�dIL9�-�h'q�L��xMeԲ��k輮��N��-C��a��1�;�`G��D��Jg��}>O��H`��f��X/U;��HD�P��Ŝ��^�L�=Z$<n=l�G��GYزz7>�t�R�h��K?�)3��7;��] g��?��;�_��,�{��B�sO��ۊ�d��zz��ڂ=�G�.��n%��O��o�(��_��9�7d٨�1f��㣚է�#me��=_O��P�*��&��)�q��M�z4�z�@�?��y�6�п�d3ּV7��d�#��Q��H��&uF��`�o��R��f��TTy1�bZDMV��0��Y`�l ��8�(�@v��+ŝa�~��v.4��0��{Z��aBy6G�0H�$D��X��4��@�Y��p�Pg2��W�r�/��iA#|��)��;kiL%�j"��F*o��^yY��>�ۗ&� '`�rOfy�Ң驰Ac{��̸��n��}<*- 4;�5ã~�X��"�e�,q�Q�z�f��[�P��r��y�q�3�7��Շ9�όSW��-�ӿ8!~X��]�c�(�Ns�F'�L�_{0��"�c��gZ��0��b{�Z�0ۂ�_��W^3�Daa1�2�&M�Ҷ�-�m��Y�|��r[��4W��,�]T=kݐ-;�HU�5:2L�m�� D;�=;�< S�1��1��sp�"��u�Q��7e�A;VLʼ%di�dpU|��~��e�XP��lc0t�a6ǐ��<�g*}��c��k��U�-� 89M��.,��K?��:��2�Բ�HvTS��SQC��Z� "u�V*�$�[��+[$V��e�˔�n�W�`��+�>=��$^��\y<��B�'�7n)��ߋn�Ona��9��<�q,�� Uv��@��rI#$j�V��X��݅��,Vx��4�[ ��~b+U�x��F{��y�O�蹄=�rKrgV�0KU]�4�pop� d��&:�w�F�Jw�[�!�a�"�h��ndi�T�@��[�NHo1q[�DK��d�L0щn4�7�%)+9�y�*�'��%V�PP9<9x�?�UC�M��Y�5E��Qo9 x��2�$ڮ�/lyН(��MwrB��ާ��D��о�0��>\��B�(.��H�:��7�7U��h��`F��O�p�V*�f�i��/��:�n��ךs.{e��H��qzO��H�¤~&��Q�aHx��1�8��ٖ�YSï]�f�@�MuFN��j��(t�ʇ��Ċ1,��F-|��LYy� �%=�� XWy��<��s��}@g�c�~��J�+n-�6�r�y(Jq��k7t��(�Ia�LÁ��1F �6��\'$�X�%<�ze�HdD��U�l��z�� J{�m7㠼VL�h��!�+�,R�A"��PoOqA�~�{�8&��S��4=�p�%n��5ъ�hJ0��%��v�u��[`�v��_�;�:*��1��j'<kF�[]X��a�WU8�y+��/��)��^��AXy�乗8�Ypq�W#�P�K��*Z%��{��ڪ�ї��m��y�Wf�ՠd5�?)b��,�?82f%�ϟ�� U^r� �P��Rq9-d�T��t��\hf.[��$�P�_rMHp?�Eq�hS

Sections

.text
Size: 496KB - Virtual size: 495KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 143KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.upp0
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.upp1
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.upp2
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

89e04b8eeb162420e348a8a094ca126d

Headers

DLL Characteristics

File Characteristics

Imports

avcodec-58

avformat-58

avutil-56

swresample-3

swscale-5

kernel32

shell32

msvcp140

ws2_32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

user32

Exports

Exports

Sections

.text Size: 496KB - Virtual size: 495KB

.rdata Size: 143KB - Virtual size: 142KB

.data Size: 24KB - Virtual size: 25KB

.upp0 Size: 3.1MB - Virtual size: 3.1MB

.upp1 Size: 2KB - Virtual size: 1KB

.upp2 Size: 2.9MB - Virtual size: 2.9MB

.rsrc Size: 512B - Virtual size: 469B

.text
Size: 496KB - Virtual size: 495KB

.rdata
Size: 143KB - Virtual size: 142KB

.data
Size: 24KB - Virtual size: 25KB

.upp0
Size: 3.1MB - Virtual size: 3.1MB

.upp1
Size: 2KB - Virtual size: 1KB

.upp2
Size: 2.9MB - Virtual size: 2.9MB

.rsrc
Size: 512B - Virtual size: 469B