e0380b33d3d6286f4f203066543a2778305cb072d1fda49666695b102e343459

Sharing

Copy URL Twitter E-mail

General

Target

e0380b33d3d6286f4f203066543a2778305cb072d1fda49666695b102e343459
Size

815KB
MD5

eec656e94ab054d75ed0ac9d27d572c9
SHA1

a8117ba0744feaf0cf82b78356d9266871a5729b
SHA256

e0380b33d3d6286f4f203066543a2778305cb072d1fda49666695b102e343459
SHA512

5a24636bdaee6cc5eb2d775e676d6c1a1524b407f177a3fe3eae80ae5a4fe6a69fe3b9bc8fab7907fd61d4e059c7331a63e7c4169d7b0be813b1c4b63d3a55a1
SSDEEP

12288:K8nOiGtqX5rUmm+4/7C+QFwMQ68X+JtVoun1rUB:RO1tqXlUr/7xQFbDTxUB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e0380b33d3d6286f4f203066543a2778305cb072d1fda49666695b102e343459

Files

e0380b33d3d6286f4f203066543a2778305cb072d1fda49666695b102e343459
.dll windows:6 windows x64 arch:x64

adaebd408d06a1b502f945a56c4078cb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

s:\p4client\Consumer\MainRel4\Products\Release\x64\MaxxAudioIntelKabylake64.pdb

Imports

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleA
FreeLibraryAndExitThread
LoadResource
FindResourceExW
GetModuleHandleExW
GetModuleHandleW
LoadLibraryExW
GetModuleFileNameW
GetModuleFileNameA
LockResource
FreeLibrary
SizeofResource

api-ms-win-core-com-l1-1-0

CLSIDFromString
CoTaskMemFree
CoUninitialize
PropVariantClear
CoCreateInstance

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapReAlloc
HeapSize
HeapFree
HeapDestroy
HeapAlloc

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx
CreateEventW
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
ResetEvent
WaitForSingleObject
ReleaseSemaphore
DeleteCriticalSection
ReleaseMutex
CreateMutexW
SetEvent

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
GetStringTypeW
MultiByteToWideChar

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
RaiseException
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA
LoadLibraryW
FindResourceW

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-file-l1-1-0

CreateDirectoryW
SetFilePointerEx
GetFileType
SetEndOfFile
ReadFile
WriteFile
FindNextFileA
FlushFileBuffers
FindFirstFileExA
CreateFileW
FindClose

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount64
GetVersionExW
GetLogicalProcessorInformation
GetTickCount

api-ms-win-core-debug-l1-1-0

OutputDebugStringW

api-ms-win-core-localization-l1-2-0

GetACP
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
LCMapStringW
GetCPInfo
IsValidCodePage
GetOEMCP

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-processthreads-l1-1-0

ExitProcess
GetCurrentThread
GetThreadPriority
SetThreadPriority
TerminateProcess
CreateThread
SwitchToThread
GetCurrentProcessId
GetCurrentProcess
GetStartupInfoW
TlsFree
TlsSetValue
GetCurrentThreadId
TlsGetValue
TlsAlloc

api-ms-win-security-base-l1-1-0

FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
AllocateAndInitializeSid

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW

api-ms-win-core-memory-l1-1-0

VirtualFree
VirtualAlloc
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
VirtualProtect

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject
UnregisterWait

api-ms-win-core-processthreads-l1-1-1

GetThreadTimes
IsProcessorFeaturePresent

kernel32

LeaveCriticalSection
IsDebuggerPresent
EnterCriticalSection

ole32

CoInitialize

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-synch-l1-2-0

Sleep
SignalObjectAndWait

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx
RtlPcToFileHeader
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-interlocked-l1-1-0

QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
UnregisterWaitEx
CreateTimerQueue
ChangeTimerQueueTimer
CreateTimerQueueTimer

api-ms-win-core-systemtopology-l1-1-0

GetNumaHighestNodeNumber

api-ms-win-core-processtopology-obsolete-l1-1-0

SetThreadAffinityMask
GetProcessAffinityMask

api-ms-win-core-processenvironment-l1-1-0

FreeEnvironmentStringsW
GetStdHandle
GetEnvironmentStringsW
GetCommandLineW
SetStdHandle
GetCommandLineA

api-ms-win-core-console-l1-1-0

ReadConsoleW
GetConsoleMode
WriteConsoleW
GetConsoleCP

Exports

Exports

LoadParametersFromFile
WavesFX_GetParameter
WavesFX_Initialize
WavesFX_IsConnectionActive
WavesFX_SetParameter
WavesFX_Uninitialize

Sections

.text
Size: 347KB - Virtual size: 346KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_CODE
Size: 177KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 225KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

adaebd408d06a1b502f945a56c4078cb

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-util-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-processthreads-l1-1-1

kernel32

ole32

api-ms-win-core-profile-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-systemtopology-l1-1-0

api-ms-win-core-processtopology-obsolete-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-console-l1-1-0

Exports

Exports

Sections

.text Size: 347KB - Virtual size: 346KB

RT_CODE Size: 177KB - Virtual size: 176KB

.rdata Size: 225KB - Virtual size: 224KB

.data Size: 13KB - Virtual size: 22KB

.pdata Size: 20KB - Virtual size: 20KB

.gfids Size: 3KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 347KB - Virtual size: 346KB

RT_CODE
Size: 177KB - Virtual size: 176KB

.rdata
Size: 225KB - Virtual size: 224KB

.data
Size: 13KB - Virtual size: 22KB

.pdata
Size: 20KB - Virtual size: 20KB

.gfids
Size: 3KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 5KB