20f6ac7df366bfa7a60fbcbc7a2e2ebd05d3290222a0f27fcfb55fc2f7438ada

Sharing

Copy URL Twitter E-mail

General

Target

20f6ac7df366bfa7a60fbcbc7a2e2ebd05d3290222a0f27fcfb55fc2f7438ada
Size

525KB
MD5

742b0d4400fa141d504806a7248b418c
SHA1

ea73e700df1edd0e5090564fc9c6e889a447c140
SHA256

20f6ac7df366bfa7a60fbcbc7a2e2ebd05d3290222a0f27fcfb55fc2f7438ada
SHA512

2d35fe685ad9eb2410c68acd18fbdc89ccd0877d03d76278cc3f442538e917a641835f3a1495f7ce75e1db107ce0cfde13a5ba2ff86d48b24e7ee58179649351
SSDEEP

12288:+cMhz2IHk51b8MeMAtvuxcjcWt93xyF5Smy9ModE8LQYg:+cMhzMAt2iYw93xmyyod1UYg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20f6ac7df366bfa7a60fbcbc7a2e2ebd05d3290222a0f27fcfb55fc2f7438ada

Files

20f6ac7df366bfa7a60fbcbc7a2e2ebd05d3290222a0f27fcfb55fc2f7438ada
.exe windows:4 windows x86 arch:x86

7ff9aacd9f78fd0b5c5c68330c25aa16

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\SourceCodeDev\NineWorldsCodeDev\tools\launcher\source\bin\Release\GenPatchRuntime.pdb

Imports

kernel32

InterlockedExchangeAdd
LoadLibraryA
GetVersionExA
GetCurrentThreadId
DeleteCriticalSection
GetModuleHandleA
EnterCriticalSection
GetThreadLocale
InterlockedExchange
RaiseException
FlushInstructionCache
GetACP
CreateProcessA
LeaveCriticalSection
InitializeCriticalSection
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
IsBadCodePtr
QueryPerformanceCounter
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetProcessHeap
HeapFree
GetCurrentProcess
HeapAlloc
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetOEMCP
FlushFileBuffers
ReadFile
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
CloseHandle
CreateMutexA
GetLastError
UnhandledExceptionFilter
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
HeapSize
GetProcAddress
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
LCMapStringW
LCMapStringA
RtlUnwind
GetCPInfo
VirtualAlloc
VirtualProtect
CreateThread
SetFileTime
GetFileTime
CreateFileA
GetFileSize
GetSystemTimeAsFileTime
GetFileAttributesA
CreateDirectoryA
SetCurrentDirectoryA
RemoveDirectoryA
SetFileAttributesA
MoveFileA
GetCurrentDirectoryA
DeleteFileA
AllocConsole
Process32First
GetLogicalDrives
GetStdHandle
AttachConsole
Process32Next
GetModuleFileNameA
CreateToolhelp32Snapshot
GetDiskFreeSpaceExA
ExitProcess
SetFilePointer
WaitForSingleObject
GetTickCount
WriteFile
SetLastError
OutputDebugStringA
ReleaseMutex
GetCurrentProcessId
ExpandEnvironmentStringsA
InitializeCriticalSectionAndSpinCount
GetExitCodeProcess
TerminateProcess
GetCurrentThread
IsDebuggerPresent
FileTimeToDosDateTime
GlobalMemoryStatus
VirtualQuery
lstrcpynA
SetUnhandledExceptionFilter
IsBadStringPtrA
Module32First
GetLocalTime
GetSystemInfo
Module32Next
FileTimeToLocalFileTime
GetVersion
LocalFree
FindResourceA
lstrlenA
FreeLibrary
LoadResource
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
SizeofResource
IsDBCSLeadByte
MultiByteToWideChar
lstrlenW
lstrcmpiA
LoadLibraryExA
IsBadReadPtr
HeapReAlloc
GetStartupInfoA
GetCommandLineA
SetStdHandle
GetFileType
GetTimeZoneInformation
ExitThread

user32

SystemParametersInfoA
SetWindowPos
MapWindowPoints
GetSystemMetrics
EnableWindow
CallWindowProcA
SetWindowTextA
LoadImageA
GetDlgItem
EndDialog
CreateWindowExA
GetWindowLongA
UnregisterClassA
LoadCursorA
GetWindow
IsWindow
PostMessageA
DefWindowProcA
GetActiveWindow
DialogBoxParamA
GetWindowRect
RegisterClassExA
GetClassInfoExA
GetParent
LoadIconA
wsprintfA
GetClientRect
SendMessageA
GetWindowTextA
CharNextA
SetWindowLongA
MessageBoxA

gdi32

GetStockObject
GetObjectA
DeleteObject
CreateFontIndirectA

shell32

ShellExecuteExA
SHGetPathFromIDListA
SHBrowseForFolderA

oleaut32

VarUI4FromStr

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

shlwapi

wnsprintfA

dbghelp

SymSetOptions
SymInitialize
SymFromAddr
SymGetTypeInfo
SymGetLineFromAddr
SymCleanup
SymFunctionTableAccess
SymGetModuleBase
MiniDumpWriteDump
StackWalk
SymEnumSymbols
UnDecorateSymbolName
SymSetContext

advapi32

RegCloseKey
RegQueryValueExA
RegEnumKeyExA
GetUserNameA
RegDeleteKeyA
RegDeleteValueA
RegQueryInfoKeyA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA

ole32

CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance

Sections

.text
Size: 304KB - Virtual size: 300KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7ff9aacd9f78fd0b5c5c68330c25aa16

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

oleaut32

version

shlwapi

dbghelp

advapi32

ole32

Sections

.text Size: 304KB - Virtual size: 300KB

.rdata Size: 56KB - Virtual size: 55KB

.data Size: 12KB - Virtual size: 18KB

.rsrc Size: 8KB - Virtual size: 5KB

.text
Size: 304KB - Virtual size: 300KB

.rdata
Size: 56KB - Virtual size: 55KB

.data
Size: 12KB - Virtual size: 18KB

.rsrc
Size: 8KB - Virtual size: 5KB