Audio Router[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Audio Router.exe
Size

315KB
MD5

6a332d1a69e389a847a7b8698aa2d6a1
SHA1

39036e85117ac35acaaa230b243b6adeccc4ac0c
SHA256

d6b64fb937d1f85439462f7ce0f104636f3e0650a4613f8ce5b1f85e553e7fac
SHA512

0016746edade378b818fed20cf91240f54db724b1d88b78720e7b2a65fee260fdd9e7dc5ef1600a2fc07d503078c77ca0df71d0abf45020f1ae03a395c316211
SSDEEP

6144:K8CBI91dTiDRZvLE9nTarNFptzCBt6pqN7WqYSW95R:KXBc1d2/vDoMPqZk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Audio Router.exe

Files

Audio Router.exe
.exe windows:6 windows x64 arch:x64

a281c93936c224b3c3dac92bb028ab94

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

send
connect
WSAStartup
getaddrinfo
recv
socket
freeaddrinfo
closesocket

kernel32

GetLastError
HeapSize
CreateFileMappingW
LockResource
DecodePointer
DeleteCriticalSection
CloseHandle
K32GetModuleBaseNameW
OpenProcess
IsWow64Process
K32EnumProcesses
K32EnumProcessModulesEx
K32GetModuleFileNameExW
CreateFileW
lstrcmpiW
GetCurrentThreadId
GetCurrentProcess
LeaveCriticalSection
FlushInstructionCache
SetLastError
EnterCriticalSection
ExpandEnvironmentStringsW
GetModuleHandleW
IsBadReadPtr
LocalFree
MulDiv
CreateMutexW
FreeLibrary
LoadLibraryExW
MultiByteToWideChar
GetProcAddress
WriteFile
FlushFileBuffers
CreateThread
ReleaseMutex
EndUpdateResourceW
LoadLibraryW
BeginUpdateResourceW
UpdateResourceW
FormatMessageW
LocalAlloc
VerSetConditionMask
lstrlenW
VerifyVersionInfoW
RaiseException
TerminateProcess
Sleep
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
GetCPInfo
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
GetCommandLineA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
OutputDebugStringW
IsDebuggerPresent
EncodePointer
GetStringTypeW
WideCharToMultiByte
TlsSetValue
TlsFree
GetStartupInfoW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
IsValidCodePage
GetACP
GetOEMCP
InitializeCriticalSectionEx
GetModuleFileNameW
GetExitCodeProcess
HeapDestroy
GetStdHandle
TlsGetValue
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
SizeofResource
GetProcessHeap
WaitForSingleObject
HeapFree
HeapAlloc
CreateProcessW
LoadResource
FindResourceW
FindResourceExW
UnmapViewOfFile
MapViewOfFile
HeapReAlloc
FreeEnvironmentStringsW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
SetStdHandle
WriteConsoleW
TlsAlloc

user32

GetScrollRange
GetScrollInfo
SystemParametersInfoW
SetScrollPos
ScrollWindow
SetScrollInfo
GetScrollPos
GetMessageW
CharNextW
LoadImageW
LoadCursorW
RemoveMenu
TranslateMessage
LoadAcceleratorsW
RegisterClassExW
LoadStringW
GetMenuItemCount
CreatePopupMenu
PeekMessageW
AppendMenuW
UpdateWindow
DispatchMessageW
InvalidateRect
SetFocus
MapWindowPoints
SetTimer
TrackPopupMenu
IsIconic
TrackPopupMenuEx
PostQuitMessage
LoadStringA
GetClassInfoExW
MessageBeep
GetSubMenu
DialogBoxParamW
GetParent
IsWindowEnabled
GetWindowLongPtrW
LoadMenuW
IsWindowVisible
DestroyMenu
DrawFrameControl
GetMonitorInfoW
CallWindowProcW
DefWindowProcW
GetWindowThreadProcessId
DestroyWindow
GetWindowTextLengthW
ScreenToClient
GetWindowRect
MapDialogRect
PostMessageW
DrawTextW
SetParent
GetClientRect
GetDC
GetMenuItemInfoW
EndDialog
PtInRect
GetWindowLongW
GetWindowTextW
ReleaseDC
GetDlgItem
SetWindowLongW
RedrawWindow
SetWindowPos
ShowWindow
CreateDialogParamW
CreateWindowExW
GetSystemMetrics
SetWindowLongPtrW
SendMessageW
EnableWindow
SetWindowTextW
DestroyIcon
EnumWindows
IsDialogMessageW
IsWindow
MessageBoxW
UnregisterClassW
MonitorFromPoint

gdi32

ExtTextOutW
GetStockObject
GetTextMetricsW

advapi32

InitializeSecurityDescriptor
CreateWellKnownSid
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
RegCreateKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
FreeSid
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetEntriesInAclW

shell32

ExtractAssociatedIconW
ExtractIconExW

ole32

PropVariantClear
CoTaskMemFree
CoUninitialize
CoTaskMemRealloc
CoTaskMemAlloc
CoInitializeEx
CoCreateInstance

oleaut32

VarUI4FromStr

shlwapi

PathRemoveFileSpecW
StrDupW

comctl32

ord410
ord412
ord413

gdiplus

GdipGraphicsClear
GdipDrawImageRectI
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipAlloc
GdipGetImageHeight
GdipCreateLineBrushFromRectI
GdipFree
GdipDeleteBrush
GdipDisposeImage
GdipCreateFromHDC
GdipFillRectangleI
GdipCloneImage
GdipGetImageWidth
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromScan0

netapi32

NetServerGetInfo
NetApiBufferFree

Sections

.text
Size: 193KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a281c93936c224b3c3dac92bb028ab94

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

netapi32

Sections

.text Size: 193KB - Virtual size: 192KB

.rdata Size: 81KB - Virtual size: 80KB

.data Size: 12KB - Virtual size: 23KB

.pdata Size: 11KB - Virtual size: 11KB

.rsrc Size: 13KB - Virtual size: 13KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 193KB - Virtual size: 192KB

.rdata
Size: 81KB - Virtual size: 80KB

.data
Size: 12KB - Virtual size: 23KB

.pdata
Size: 11KB - Virtual size: 11KB

.rsrc
Size: 13KB - Virtual size: 13KB

.reloc
Size: 3KB - Virtual size: 2KB