6bc977e1c6f1731d25c2cd04f34605d0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

6bc977e1c6f1731d25c2cd04f34605d0N.exe
Size

852KB
MD5

6bc977e1c6f1731d25c2cd04f34605d0
SHA1

d45e72e6707b5d14dc65b34ad7ca34077c6103e4
SHA256

e5bba5f455ef1e091e4256a1de558f0c14a39309f16f8dd9ca8049809dd60593
SHA512

481cc2fb31656fa583e469ed1bdb97d4112879544bddaf9e4a3687e9bafc47e30be56fcf0161ba6e86dfd2d49d449349be689c1087aeb4aa2214a534c9a22438
SSDEEP

24576:srs3MldetdVBCmDnxq5qAcid6RasGB75SWKGz1D1:escutdV9DnxkqBid6R0t5D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6bc977e1c6f1731d25c2cd04f34605d0N.exe

Files

6bc977e1c6f1731d25c2cd04f34605d0N.exe
.dll windows:6 windows x64 arch:x64

92a8095c31e455a6233d9f82cb537e45

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\builds\build-sourcemod-msvc12\windows-1.12\OUTPUT\core\sourcemod.2.tf2\windows-x86_64\sourcemod.2.tf2.pdb

Imports

kernel32

GetLastError
FreeLibrary
GetProcAddress
LoadLibraryA
FormatMessageA
GetFileAttributesA
WriteConsoleW
SetEndOfFile
ReadConsoleW
ReadFile
HeapSize
CreateFileW
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
SetStdHandle
GetStringTypeW
SetFilePointerEx
GetFileSizeEx
CreateDirectoryW
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
LCMapStringW
GetModuleHandleA
LoadLibraryExA
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
CloseHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetDriveTypeW
GetFullPathNameW
SetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType

tier0

MemAllocScratch
MemFreeScratch
SpewOutputFunc
GetSpewOutputFunc
AssertValidStringPtr
_AssertValidWritePtr
_AssertValidReadPtr
ThreadWaitForObjects
GetThreadedLoadLibraryFunc
ReleaseThreadHandle
CreateSimpleThread
CommandLine_Tier0
?DevWarning@@YAXPEBDZZ
Error
Plat_IsInDebugSession
?ConMsg@@YAXPEBDZZ
?ConColorMsg@@YAXAEBVColor@@PEBDZZ
g_pMemAlloc
?Lock@CThreadFastMutex@@AECAX_KI@Z
ThreadGetCurrentId
?DevMsg@@YAXPEBDZZ
DevMsg
Msg
GetCPUInformation
g_VProfCurrentProfile
?OutputReport@CVProfile@@QEAAXHPEBDH@Z
?Pause@CVProfile@@QEAAXXZ
?ExitScope@CVProfile@@QEAAXXZ
?EnterScope@CVProfile@@QEAAXPEBDH0_NH@Z
?Resume@CVProfNode@@QEAAXXZ
Warning

vstdlib

RandomFloat
RandomInt
KeyValuesSystem
RandomSeed

Exports

Exports

CreateInterface
cvar

Sections

.text
Size: 598KB - Virtual size: 597KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 166KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 43KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

92a8095c31e455a6233d9f82cb537e45

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

tier0

vstdlib

Exports

Exports

Sections

.text Size: 598KB - Virtual size: 597KB

.rdata Size: 166KB - Virtual size: 166KB

.data Size: 43KB - Virtual size: 104KB

.pdata Size: 35KB - Virtual size: 35KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 1024B - Virtual size: 880B

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 598KB - Virtual size: 597KB

.rdata
Size: 166KB - Virtual size: 166KB

.data
Size: 43KB - Virtual size: 104KB

.pdata
Size: 35KB - Virtual size: 35KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 1024B - Virtual size: 880B

.reloc
Size: 6KB - Virtual size: 6KB