de3fef2ad9d37f0da17bef41cef6b290N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

de3fef2ad9d37f0da17bef41cef6b290N.exe
Size

802KB
MD5

de3fef2ad9d37f0da17bef41cef6b290
SHA1

80040347e89a529b7bb2747be3270b9ed630c56b
SHA256

66d32b10f35f22cefc527466511b68068cd81c488ef3d80574ea16e7c4df0eb3
SHA512

1f8638e286b9cb789bb7e5f41a168a6ff26ee27b26715d4fb5a4e549de295e73bc2c3dbe31f2651f645bd9d7071c603c29606ba411b1d7b5814ba1e303548146
SSDEEP

12288:+dqHn44YUoGf+bwSMBd807psFcCPFMyVuOqiIjKH:9HnVYUoGf8wJBdb7psdPgiwS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de3fef2ad9d37f0da17bef41cef6b290N.exe

Files

de3fef2ad9d37f0da17bef41cef6b290N.exe
.dll windows:10 windows x86 arch:x86

f0839c4846f7a7ffed88d1d96eb12022

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

rdvgogl32.pdb

Imports

msvcrt

islower
calloc
isupper
__pctype_func
abort
??1type_info@@UAE@XZ
__CxxFrameHandler3
?terminate@@YAXXZ
_free_locale
_get_current_locale
__crtLCMapStringA
__crtLCMapStringW
__crtCompareStringA
__crtCompareStringW
_wcsdup
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
localeconv
??0bad_cast@@QAE@PBD@Z
_onexit
__dllonexit
strcspn
ldexp
realloc
_initterm
_amsg_exit
_XcptFilter
_unlock
isdigit
_lock
_Getdays
isalnum
memcmp
___lc_collate_cp_func
memchr
tolower
isspace
memset
_Strftime
_ismbblead
___lc_codepage_func
___lc_handle_func
___mb_cur_max_func
_errno
memmove
memcpy
_CxxThrowException
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@XZ
_callnewh
sscanf_s
_aligned_malloc
_aligned_free
_vsnwprintf
??_V@YAXPAX@Z
strtok_s
sprintf_s
malloc
free
__mb_cur_max
_Gettnames
_Wcsftime
??0exception@@QAE@ABQBD@Z
_ftol2_sse
_ftol2
_CIsin
setlocale
_except_handler4_common
_W_Gettnames
_W_Getmonths
_W_Getdays
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
memcpy_s
_purecall
??3@YAXPAX@Z
_Getmonths
_CIcos
ceil

advapi32

GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage

user32

UnhookWindowsHookEx
SetPropW
AdjustWindowRect
GetWindowInfo
GetClientRect
CallNextHookEx
ReleaseDC
GetDC
MessageBoxW
LoadStringW
WindowFromDC
EnumDisplayDevicesW
SetWindowsHookExW

kernel32

GetStringTypeW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
DecodePointer
EncodePointer
GetCurrentProcessId
InitializeCriticalSectionEx
WideCharToMultiByte
MultiByteToWideChar
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
VirtualFree
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
Sleep
GetModuleFileNameW
SetUnhandledExceptionFilter
GetLocaleInfoW
GetSystemInfo
TlsSetValue
GetWriteWatch
ResetWriteWatch
GetCurrentThreadId
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
TlsAlloc
TlsFree
GetLastError
GetModuleHandleW
GetProcAddress
ResolveDelayLoadedAPI
DelayLoadFailureHook
TlsGetValue
VirtualAlloc

gdi32

SetPixelFormat
DeleteDC
CreateCompatibleDC
ChoosePixelFormat
CreateDCW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

ntdll

RtlIsCriticalSectionLockedByThread

d3d11

D3D11CreateDevice

opengl32

glGetTexLevelParameteriv
wglCreateContext

glu32

gluErrorString

rfxvmt

RfxVmtCloseChannel
RfxVmtReadChannel
RfxVmtWriteChannel
RfxVmtGetDataAvailableEvent
RfxVmtCreateChannel

Exports

Exports

DllMain
DrvCopyContext
DrvCreateContext
DrvCreateLayerContext
DrvDeleteContext
DrvDescribeLayerPlane
DrvDescribePixelFormat
DrvGetLayerPaletteEntries
DrvGetProcAddress
DrvPresentBuffers
DrvRealizeLayerPalette
DrvReleaseContext
DrvSetCallbackProcs
DrvSetContext
DrvSetLayerPaletteEntries
DrvSetPixelFormat
DrvShareLists
DrvSwapBuffers
DrvSwapLayerBuffers
DrvSwapMultipleBuffers
DrvValidateVersion

Sections

.text
Size: 623KB - Virtual size: 622KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 169KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f0839c4846f7a7ffed88d1d96eb12022

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

user32

kernel32

gdi32

version

ntdll

d3d11

opengl32

glu32

rfxvmt

Exports

Exports

Sections

.text Size: 623KB - Virtual size: 622KB

.data Size: 2KB - Virtual size: 3KB

.idata Size: 4KB - Virtual size: 4KB

.didat Size: 512B - Virtual size: 8B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 169KB - Virtual size: 169KB

.text
Size: 623KB - Virtual size: 622KB

.data
Size: 2KB - Virtual size: 3KB

.idata
Size: 4KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 169KB - Virtual size: 169KB