ac3614342ef5bafddab8f39d08408cfe96dfdb67e5224809c71e02bd82366e56

Sharing

Copy URL

Twitter E-mail

General

Target

ac3614342ef5bafddab8f39d08408cfe96dfdb67e5224809c71e02bd82366e56
Size

1.8MB
MD5

b477a97b334ee27460b4817ced917287
SHA1

9748dee3c74a420225130120e6e11dcdf2bda65d
SHA256

ac3614342ef5bafddab8f39d08408cfe96dfdb67e5224809c71e02bd82366e56
SHA512

6eed2797aea3c61eceec78b07ba831928501008f512d8bac4f35fecbbb145b1677afc5c45ae4d36066bfe7e2d5a94953709025e597a2ce0e6956950751ce2850
SSDEEP

49152:k4irRPWkZEy+32psE4Cq1kPsDi51UJvr:k9rRtZ7+32p+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ac3614342ef5bafddab8f39d08408cfe96dfdb67e5224809c71e02bd82366e56

Files

ac3614342ef5bafddab8f39d08408cfe96dfdb67e5224809c71e02bd82366e56
.exe windows:5 windows x86 arch:x86

25dd92d754ce1d64c6fc0c7448c8fa1e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\client_build\PRODUCTION\PokerStars\UNIVERSAL\gameutil\Release\Win32\bin\gameutil2.pdb

Imports

pdh

PdhGetFormattedCounterValue
PdhCollectQueryData
PdhAddCounterA
PdhOpenQueryA

wsock32

WSAStartup
closesocket
recv
send
shutdown
WSASetLastError
WSAGetLastError

kernel32

InitializeCriticalSection
CloseHandle
GetCurrentThreadId
FormatMessageA
SetLastError
GetSystemTime
GetSystemTimeAsFileTime
GetLocalTime
GetTimeZoneInformation
SystemTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
MultiByteToWideChar
SetEvent
ResetEvent
ReleaseMutex
WaitForMultipleObjects
MapViewOfFile
UnmapViewOfFile
CreateMutexA
OpenMutexA
CreateEventA
OpenEventA
CreateFileMappingA
OpenFileMappingA
GetProcessAffinityMask
GetCurrentProcess
GetCurrentProcessId
WriteFile
SetFilePointer
GetModuleHandleA
CreateFileW
GetProcAddress
GetCurrentThread
SetThreadPriority
PulseEvent
ReleaseSemaphore
Sleep
CreateSemaphoreA
LoadLibraryExA
FreeLibrary
GlobalAlloc
GlobalLock
GlobalUnlock
lstrcmpW
GetModuleFileNameA
GetModuleFileNameW
CreateProcessA
CreateProcessW
GetSystemDirectoryA
GetSystemDirectoryW
GetWindowsDirectoryA
GetWindowsDirectoryW
SetCurrentDirectoryA
SetCurrentDirectoryW
GetCurrentDirectoryA
GetCurrentDirectoryW
GetDriveTypeW
OpenProcess
ReadFile
FindClose
FindFirstFileW
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetTickCount
WaitForSingleObject
SetEndOfFile
HeapSize
WriteConsoleW
OutputDebugStringW
OutputDebugStringA
GetProcessHeap
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
FindNextFileA
FindFirstFileExW
FindFirstFileExA
SetStdHandle
SetFilePointerEx
FlushFileBuffers
DecodePointer
MoveFileExW
DeleteFileW
GetConsoleCP
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetFullPathNameA
GetDateFormatW
GetStringTypeW
HeapReAlloc
HeapAlloc
HeapFree
GetACP
SetConsoleMode
ReadConsoleInputA
PeekConsoleInputA
GetNumberOfConsoleInputEvents
GetConsoleMode
SetConsoleCtrlHandler
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
PeekNamedPipe
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetLastError
GetProcessTimes
FindFirstFileA
SystemTimeToTzSpecificLocalTime
GetFullPathNameW
GetVersionExA
GetStdHandle
GetFileType
QueryPerformanceCounter
LoadLibraryA
GlobalMemoryStatus
FlushConsoleInputBuffer
QueryPerformanceFrequency
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RaiseException
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
EncodePointer
LoadLibraryExW
CreateThread
ExitThread

user32

SetTimer
LoadStringA
LoadIconA
LoadCursorA
GetClientRect
EndPaint
BeginPaint
UpdateWindow
DrawTextA
TranslateAcceleratorA
LoadAcceleratorsA
EndDialog
DialogBoxParamA
ShowWindow
DestroyWindow
RegisterClassExA
PostQuitMessage
DefWindowProcA
DispatchMessageA
TranslateMessage
GetMessageA
LoadImageW
SetWindowsHookExW
SetWindowLongW
GetWindowLongW
MessageBoxW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
DrawTextW
AppendMenuW
GetSystemMetrics
GetKeyState
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
CreateDialogIndirectParamW
SetWindowPos
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
DefWindowProcW
PostThreadMessageW
PostMessageW
SendMessageW
PeekMessageW
DispatchMessageW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
GetDC
ReleaseDC
GetMessageW
KillTimer
CreateWindowExA

gdi32

SelectObject
GetDIBits
DeleteObject
CreateCompatibleBitmap
GetDeviceCaps
GetObjectA
SetDIBits

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegisterEventSourceA
ReportEventA
DeregisterEventSource

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 316KB - Virtual size: 315KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

25dd92d754ce1d64c6fc0c7448c8fa1e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

pdh

wsock32

kernel32

user32

gdi32

advapi32

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 316KB - Virtual size: 315KB

.data Size: 35KB - Virtual size: 49KB

.rsrc Size: 32KB - Virtual size: 32KB

.reloc Size: 64KB - Virtual size: 64KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 316KB - Virtual size: 315KB

.data
Size: 35KB - Virtual size: 49KB

.rsrc
Size: 32KB - Virtual size: 32KB

.reloc
Size: 64KB - Virtual size: 64KB