b563a0d625aa148c992413947b2d3ceae678c27fd6d1eadf8e9eb3e10d5206f5[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

b563a0d625aa148c992413947b2d3ceae678c27fd6d1eadf8e9eb3e10d5206f5.exe
Size

55.0MB
MD5

70eac30776d13a02e4b6a5e6963c52b9
SHA1

b7deafce3ff7d7252ed29d6f508a49a6d1b63504
SHA256

b563a0d625aa148c992413947b2d3ceae678c27fd6d1eadf8e9eb3e10d5206f5
SHA512

fab91b7ba11ff12d2bfa2f2d2c260fa15a8b1543c108c3d81337a74d3933b7c9dc73b866ce3f294414aab031d646c52ea86251fe020501c11ff50ae2cc78a391
SSDEEP

196608:8xGxCrar4+WnAL3fljyBTEbAdoaU7wtq9oaqN:VxCGUnAL3OEEdou20N

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b563a0d625aa148c992413947b2d3ceae678c27fd6d1eadf8e9eb3e10d5206f5.exe

Files

b563a0d625aa148c992413947b2d3ceae678c27fd6d1eadf8e9eb3e10d5206f5.exe
.exe windows:6 windows x86 arch:x86

b5504d340681f80a29e585410bb19fbb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\BuildAgent\work\Buckeye\Perforce\BioShock1\master\Output_Win32\Final\BioshockHD.pdb

Imports

kernel32

GetWindowsDirectoryA
GetWindowsDirectoryW
FreeLibrary
GetModuleFileNameA
GetModuleFileNameW
GetProcAddress
LoadLibraryW
CopyFileA
CopyFileW
MoveFileA
MoveFileW
SetUnhandledExceptionFilter
GetCurrentProcess
GetCurrentProcessId
GetLocalTime
TlsGetValue
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsSetValue
TlsFree
RaiseException
WaitForSingleObject
CreateThread
GetExitCodeThread
OutputDebugStringA
LoadLibraryA
GetSystemInfo
InterlockedExchangeAdd
FlushFileBuffers
ReleaseSemaphore
ExitProcess
GetComputerNameA
GlobalMemoryStatus
CreateProcessW
SystemTimeToFileTime
GlobalLock
GetComputerNameW
GetFileAttributesExA
GetSystemDirectoryW
GetSystemDirectoryA
SetThreadPriority
GetCurrentThread
OutputDebugStringW
TerminateProcess
GetSystemTimeAsFileTime
Sleep
CreateMutexW
CreateMutexA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
QueryPerformanceFrequency
GetLastError
CloseHandle
WriteFile
SetFilePointer
SetFileAttributesW
SetFileAttributesA
RemoveDirectoryW
RemoveDirectoryA
ReadFile
GetFullPathNameA
GetFileSize
GetFileAttributesExW
GetFileAttributesW
GetFileAttributesA
GetDiskFreeSpaceExW
FindNextFileA
FindFirstFileA
DeleteFileW
DeleteFileA
CreateFileW
CreateFileA
CreateDirectoryW
CreateDirectoryA
GetCurrentDirectoryW
GetCurrentDirectoryA
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
VerSetConditionMask
VerifyVersionInfoW
GetFullPathNameW
lstrcmpW
LoadLibraryExW
GetModuleHandleA
SetLastError
lstrcmpA
LocalAlloc
IsProcessorFeaturePresent
DecodePointer
EncodePointer
GetLocaleInfoA
GetLocaleInfoW
GetSystemDefaultLangID
GlobalDeleteAtom
LockResource
LoadResource
FindResourceA
MulDiv
GlobalAddAtomW
GetModuleHandleW
LocalFree
InterlockedDecrement
InterlockedIncrement
SetFilePointerEx
SetThreadIdealProcessor
ResumeThread
SuspendThread
TerminateThread
SetThreadAffinityMask
CreateSemaphoreW
ResetEvent
SetEvent
CreateEventA
PulseEvent
TryEnterCriticalSection
ExpandEnvironmentStringsW
DebugBreak
GetVersionExA
IsDebuggerPresent
lstrlenA
GetCurrentThreadId
InitializeCriticalSectionEx
SetCurrentDirectoryW
SetConsoleCtrlHandler
GlobalUnlock
CreateProcessA
GetExitCodeProcess
GetVersionExW
FormatMessageW
GlobalAlloc
GetCommandLineA
FormatMessageA
QueryPerformanceCounter
FindNextFileW
FindFirstFileW
FindClose
InterlockedCompareExchange
InterlockedExchange
GetTickCount

user32

PeekMessageW
MessageBoxW
RegisterWindowMessageA
RegisterWindowMessageW
DispatchMessageA
PeekMessageA
SendMessageA
SendMessageW
SendMessageTimeoutW
DestroyWindow
ShowWindow
SetWindowPos
CreateDialogParamA
CreateDialogParamW
AdjustWindowRect
SetCursorPos
DispatchMessageW
TranslateMessage
SetActiveWindow
GetMenu
GetMenuState
GetKeyNameTextW
GetDlgItem
SetFocus
keybd_event
MapVirtualKeyW
GetSystemMetrics
UpdateWindow
GetForegroundWindow
SetForegroundWindow
SetPropA
SetPropW
GetPropA
GetPropW
RemovePropA
RemovePropW
GetDesktopWindow
FindWindowExA
FindWindowExW
GetWindowThreadProcessId
UnhookWindowsHookEx
CallNextHookEx
SystemParametersInfoW
GetFocus
GetSysColor
EnableWindow
ShowCursor
SystemParametersInfoA
AdjustWindowRectEx
GetUpdateRect
DrawTextExA
DrawTextExW
MessageBeep
CheckMenuItem
AppendMenuW
DrawFocusRect
DrawIcon
GetIconInfo
SetTimer
KillTimer
SetClassLongA
GetClassLongA
GetClassLongW
SetClassLongW
GetParent
FrameRect
DrawTextA
DrawTextW
GetDlgCtrlID
GetWindow
GetWindowTextA
CreateDialogIndirectParamA
EndDeferWindowPos
BeginDeferWindowPos
EndPaint
ClientToScreen
SetCursor
ScreenToClient
GetWindowRect
InsertMenuItemA
RegisterClassExA
TrackPopupMenu
IsIconic
FillRect
GetClassInfoExA
SetCapture
PostMessageW
IsZoomed
GetSubMenu
DialogBoxParamW
LoadMenuA
LoadIconA
LoadCursorW
IsWindowEnabled
SetMenu
UnregisterHotKey
GetAsyncKeyState
GetMessageTime
ValidateRect
SetParent
SetKeyboardState
SetRect
AttachThreadInput
WindowFromPoint
DrawEdge
MapWindowPoints
GetMenuItemInfoW
BeginPaint
GetClassInfoExW
GetCapture
GetKeyState
SetClipboardData
OpenClipboard
GetActiveWindow
EmptyClipboard
GetClipboardData
PostQuitMessage
CloseClipboard
ReleaseDC
GetDC
GetClientRect
MessageBoxA
MoveWindow
DefWindowProcW
CallWindowProcW
SetMenuItemInfoW
DialogBoxParamA
LoadCursorA
SetMenuItemInfoA
DestroyMenu
CallWindowProcA
ReleaseCapture
DefMDIChildProcA
CreateWindowExW
ClipCursor
PostMessageA
IsWindow
GetMenuItemCount
DefMDIChildProcW
GetSysColorBrush
CreatePopupMenu
EnumChildWindows
GetMenuItemInfoA
GetCursorPos
RegisterClassExW
DefWindowProcA
EndDialog
SetWindowLongW
CreateWindowExA
GetWindowLongA
GetWindowLongW
BringWindowToTop
LoadMenuW
InvalidateRect
SetWindowLongA
LoadIconW

gdi32

GetObjectA
CreateCompatibleDC
SetBkMode
DeleteObject
PatBlt
DeleteDC
BitBlt
CreatePen
MoveToEx
LineTo
Rectangle
SetTextColor
SetBkColor
ExtTextOutA
GetTextExtentPoint32W
GetTextExtentPoint32A
TextOutW
SelectObject
CreateFontW
CreateDIBitmap
GetStockObject
CreateSolidBrush
GetDeviceCaps
GetPixel

comdlg32

GetSaveFileNameA
ChooseColorA

shell32

ShellExecuteW
ShellExecuteA
SHGetFolderPathW
Shell_NotifyIconA

wsock32

WSAStartup
WSAGetLastError
gethostname
__WSAFDIsSet
accept
bind
closesocket
connect
inet_ntoa
htons
ioctlsocket
inet_addr
listen
ntohs
recv
select
send
setsockopt
socket
gethostbyname
WSAAsyncSelect

winmm

timeBeginPeriod
timeEndPeriod

advapi32

RegQueryValueExA
RegOpenKeyExA
GetUserNameW
GetUserNameA
RegCloseKey
RegSetValueExA
RegCreateKeyExA

ole32

CoUninitialize
CoSetProxyBlanket
CoCreateInstance
CoInitialize
CoCreateGuid

oleaut32

SysFreeString
SysAllocString

Sections

.text
Size: 11.8MB - Virtual size: 11.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.9MB - Virtual size: 5.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b5504d340681f80a29e585410bb19fbb

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

shell32

wsock32

winmm

advapi32

ole32

oleaut32

Sections

.text Size: 11.8MB - Virtual size: 11.8MB

.rdata Size: 2.8MB - Virtual size: 2.8MB

.data Size: 2.9MB - Virtual size: 5.3MB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 1.6MB - Virtual size: 1.6MB

.text
Size: 11.8MB - Virtual size: 11.8MB

.rdata
Size: 2.8MB - Virtual size: 2.8MB

.data
Size: 2.9MB - Virtual size: 5.3MB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 1.6MB - Virtual size: 1.6MB