AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
hx_cffi
Static task
static1
1 signatures
General
-
Target
FunkinMulti.exe
-
Size
15.4MB
-
MD5
2cf32f14cb000d1af1d0514450f3ff49
-
SHA1
adc575ed46e79dce4c6c47acd7e74d0d0548c2c0
-
SHA256
7bdc77e38f6b46af4b542fba305f96aa8024932eb4a0e5ab73a0a15d0af5b112
-
SHA512
5d12e2b8e0a464e3abe6a7af270b3cb676466dbd4990ae344a89fa408641dbc9ded364bea87692d0ba05856e39b2561b14f74f8116d065da6d06a8d516614524
-
SSDEEP
196608:0tjaaVveZ0plykebSrZeP8Lc2p0ufC1NZ9H:0tjaaVWZ0pUkebSleP8Lc2LCPZB
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource FunkinMulti.exe
Files
-
FunkinMulti.exe.exe windows:6 windows x64 arch:x64
Password: 2013
8623c22a6d0a561c3771555d813aea2b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
user32
MessageBoxA
ws2_32
getaddrinfo
WSAGetLastError
WSAStartup
gethostname
gethostbyname
socket
shutdown
setsockopt
send
select
freeaddrinfo
ntohs
listen
inet_ntoa
inet_addr
htons
getpeername
ioctlsocket
connect
closesocket
bind
accept
__WSAFDIsSet
recv
advapi32
RegOpenKeyExW
CryptReleaseContext
CryptGenRandom
RegCloseKey
RegSetKeyValueW
RegQueryValueExW
CryptAcquireContextA
RegCreateKeyExW
crypt32
CertEnumCertificatesInStore
CertOpenSystemStoreA
CertCloseStore
kernel32
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetFileAttributesExW
SetEnvironmentVariableW
GetStringTypeW
SetFilePointerEx
FlushFileBuffers
ReadConsoleW
GetConsoleMode
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
FindFirstFileExW
GetCommandLineW
GetProcessHeap
HeapSize
SetEndOfFile
GetFileSizeEx
CreateEventW
TlsGetValue
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTime
SystemTimeToFileTime
RtlCaptureContext
TlsSetValue
TlsAlloc
CloseHandle
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
CreateThread
GetCurrentThreadId
FreeLibrary
GetProcAddress
LoadLibraryW
GetCommandLineA
LoadLibraryA
ReadFile
WriteFile
DuplicateHandle
CreatePipe
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetCurrentProcessId
GetTickCount
FormatMessageA
SetCurrentDirectoryW
GetCurrentDirectoryW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetFullPathNameW
Sleep
GetModuleFileNameW
GetLastError
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
PeekNamedPipe
WaitNamedPipeW
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
SetLastError
InitializeCriticalSectionAndSpinCount
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
OutputDebugStringW
EncodePointer
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LCMapStringW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
ExitProcess
GetModuleHandleExW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetStdHandle
CreateDirectoryW
DeleteFileW
GetStdHandle
WriteConsoleW
ExitThread
GetConsoleCP
HeapFree
HeapAlloc
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
CompareStringW
Exports
Exports
Sections
.text Size: 10.7MB - Virtual size: 10.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.0MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 446KB - Virtual size: 446KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 458KB - Virtual size: 458KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 257KB - Virtual size: 257KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ