microsoft teams[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

microsoft teams.exe
Size

2.3MB
MD5

94b7fc8c4d3315e520e1dbfe7f3f6bdd
SHA1

d9f5fa0a0e6f5a270ec7337d62cb119229e36ee2
SHA256

4baa631122ab620069c35f0011711671366277112d26622ea5b54457e092e403
SHA512

b19d1e7ae818f92ed0865e3e1dd3c4b8c5fc26e4b334e77722c19f0e80436d7cc60b9ed8106784fbf841205b9ffde758d24d0a678e61999f386100c8c18caa6b
SSDEEP

49152:oKoby7ExO0E/iY9YL0Ervgtnq7nvZkX1wwuL1u8:u+Ex1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
microsoft teams.exe

Files

microsoft teams.exe
.exe windows:6 windows x64 arch:x64

69bdbc78e7a6ce5f97428e183e2dcff3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\ahmed\Desktop\سش\source codes\Malaia-FiveM\x64\Build\MCL-External.pdb

Imports

kernel32

MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
CreateFileA
GetFileSizeEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
WideCharToMultiByte
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
VerifyVersionInfoA
GetCurrentProcessId
GetCurrentThreadId
GlobalUnlock
GetSystemDirectoryA
SleepEx
LeaveCriticalSection
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
Module32NextW
Module32FirstW
CloseHandle
Process32FirstW
Process32NextW
GetLastError
Sleep
EnterCriticalSection
LocalFree
FormatMessageA
QueryFullProcessImageNameW
GetModuleHandleW
GetModuleFileNameA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateToolhelp32Snapshot
VirtualProtect
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
CreateDirectoryA
CreateThread
QueryPerformanceCounter
FreeLibrary
VerSetConditionMask
GetProcAddress
GetTickCount
QueryPerformanceFrequency
LoadLibraryA
GetModuleHandleA
IsDebuggerPresent
OpenProcess
GetStdHandle
SetConsoleTextAttribute
SetLastError
GetConsoleScreenBufferInfo
SetConsoleTitleW
ReadProcessMemory
RtlCaptureContext
WriteProcessMemory
CreateFileW

user32

OpenClipboard
GetCursorPos
SetCursorPos
ReleaseCapture
GetClientRect
SetCursor
SetCapture
LoadCursorW
GetForegroundWindow
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
SetClipboardData
GetWindowThreadProcessId
GetSystemMetrics
EmptyClipboard
GetDesktopWindow
SetWindowLongW
LoadIconW
TranslateMessage
SetLayeredWindowAttributes
CreateWindowExA
DefWindowProcA
MoveWindow
EnumWindows
FindWindowA
MessageBoxA
PeekMessageW
DispatchMessageW
ShowWindow
SetWindowPos
DestroyWindow
GetWindowRect
RegisterClassExA
GetWindow
GetWindowLongW
CloseClipboard
GetClipboardData
GetAsyncKeyState
mouse_event
SetWindowLongA
GetKeyState

msvcp140

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??Bios_base@std@@QEBA_NXZ
?setf@ios_base@std@@QEAAHHH@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Xbad_alloc@std@@YAXXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?id@?$ctype@_W@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z

d3d9

Direct3DCreate9Ex

d3dx9_43

D3DXMatrixTranspose
D3DXVec3Transform

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCompositionWindow
ImmGetContext
ImmReleaseContext
ImmSetCandidateWindow

normaliz

IdnToAscii

wldap32

ord45
ord50
ord41
ord26
ord60
ord211
ord217
ord46
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord143
ord22

crypt32

CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CryptQueryObject
CertFreeCertificateChain
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CertGetCertificateChain

ws2_32

closesocket
ntohl
gethostname
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSACleanup
WSAStartup
WSAIoctl
recv
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
WSAGetLastError
send
WSASetLastError

rpcrt4

UuidToStringA
UuidCreate
RpcStringFreeA

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy
__current_exception
__std_exception_copy
__std_terminate
strchr
_CxxThrowException
__current_exception_context
memchr
memcmp
__C_specific_handler
strrchr
memset
memmove
memcpy
strstr

api-ms-win-crt-heap-l1-1-0

calloc
realloc
_set_new_mode
free
_callnewh
malloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_getpid
_cexit
system
terminate
_configure_narrow_argv
_initialize_narrow_environment
_seh_filter_exe
_set_app_type
_initialize_onexit_table
_errno
_get_initial_narrow_environment
_register_onexit_function
_resetstkoflw
_invalid_parameter_noinfo_noreturn
_invalid_parameter_noinfo
_initterm
__sys_nerr
strerror
_register_thread_local_exe_atexit_callback
_c_exit
exit
_initterm_e
__p___argv
__p___argc
_exit
_beginthreadex

api-ms-win-crt-stdio-l1-1-0

fread_s
__acrt_iob_func
__stdio_common_vfprintf
fopen_s
__stdio_common_vsscanf
fgets
_wfopen
_pclose
fputc
_popen
fseek
ftell
_get_stream_buffer_pointers
_fseeki64
fread
__p__commode
fsetpos
ungetc
setvbuf
fgetpos
fopen
__stdio_common_vsprintf
fputs
fwrite
feof
_read
_write
_close
fgetc
_open
_lseeki64
fclose
_set_fmode
fflush

api-ms-win-crt-math-l1-1-0

powf
sqrtf
pow
fmodf
cosf
_dclass
_dsign
ceilf
acosf
sinf
atan2f
__setusermatherr

api-ms-win-crt-string-l1-1-0

strncpy
strncmp
_strdup
strcmp
_wcsicmp
strcspn
strspn
isupper
tolower
strpbrk

api-ms-win-crt-convert-l1-1-0

atoi
strtoull
strtod
strtoll
atof
strtoul
strtol

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-filesystem-l1-1-0

_fstat64
_mkdir
_access
_lock_file
_unlink
_unlock_file
_stat64

api-ms-win-crt-locale-l1-1-0

localeconv
_configthreadlocale

api-ms-win-crt-time-l1-1-0

_gmtime64
_time64

advapi32

CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
ConvertSidToStringSidA
CopySid
SetSecurityInfo
IsValidSid
InitializeAcl
GetTokenInformation
GetLengthSid
AddAccessAllowedAce
OpenProcessToken

shell32

ShellExecuteA

Sections

.text
Size: 835KB - Virtual size: 834KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 544KB - Virtual size: 543KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 938KB - Virtual size: 943KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

69bdbc78e7a6ce5f97428e183e2dcff3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

msvcp140

d3d9

d3dx9_43

dwmapi

imm32

normaliz

wldap32

crypt32

ws2_32

rpcrt4

psapi

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-conio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

advapi32

shell32

Sections

.text Size: 835KB - Virtual size: 834KB

.rdata Size: 544KB - Virtual size: 543KB

.data Size: 938KB - Virtual size: 943KB

.pdata Size: 32KB - Virtual size: 31KB

.rsrc Size: 43KB - Virtual size: 42KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 835KB - Virtual size: 834KB

.rdata
Size: 544KB - Virtual size: 543KB

.data
Size: 938KB - Virtual size: 943KB

.pdata
Size: 32KB - Virtual size: 31KB

.rsrc
Size: 43KB - Virtual size: 42KB

.reloc
Size: 2KB - Virtual size: 2KB