7221b4e2df42eb11ae19328b6fba9dbf31c898e2eb663514ec604264492c167a

Sharing

Copy URL Twitter E-mail

General

Target

7221b4e2df42eb11ae19328b6fba9dbf31c898e2eb663514ec604264492c167a
Size

2.0MB
MD5

e4212d2d9bce7ac70513538e53f1da4c
SHA1

d69aa340f1b1b2d6679d7879a289beff1cc49675
SHA256

7221b4e2df42eb11ae19328b6fba9dbf31c898e2eb663514ec604264492c167a
SHA512

66ab1714751bdb9f42603284ae8e05d7260d995c5207d34f1ffed3d836e9cad4ed9727ff81d14bec1e94ebb7eb92db6e16454cacee38fe0abff8835e18fc21d3
SSDEEP

49152:4MQi2ZIhmfUZ/MGFjpBZJhS21H+/kF7n6MDaRcts:tHhZ9b1H+/kFj9aRcS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7221b4e2df42eb11ae19328b6fba9dbf31c898e2eb663514ec604264492c167a

Files

7221b4e2df42eb11ae19328b6fba9dbf31c898e2eb663514ec604264492c167a
.exe windows:6 windows x86 arch:x86

03944d6489d2d5a20dfc1026bb79c484

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Jenkins\.jenkins\workspace\MGame\MagicPen\MagicPen_inst_uninst\bin\Uninst\Release\uninst.pdb

Imports

kernel32

WideCharToMultiByte
WaitForMultipleObjects
FindClose
FindNextFileW
SetLastError
GetFullPathNameW
FindFirstFileW
MultiByteToWideChar
CreateEventW
WaitForSingleObject
SetEvent
CloseHandle
SetCurrentDirectoryW
GetSystemDirectoryW
GetCurrentDirectoryW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameW
lstrlenW
GetCurrentProcess
GetModuleHandleW
DeleteCriticalSection
DecodePointer
RaiseException
GetLastError
InitializeCriticalSectionEx
lstrcmpiW
OutputDebugStringW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetProcessHeap
HeapAlloc
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetStdHandle
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
FreeLibrary
GetTimeZoneInformation
GetConsoleMode
LoadLibraryW
GetProcAddress
GetConsoleOutputCP
SetFilePointerEx
GetFileType
IsDebuggerPresent
FormatMessageW
GetStringTypeW
TryEnterCriticalSection
GetCurrentThreadId
EncodePointer
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
CreateFileW
MulDiv
ExitProcess
FreeResource
GetACP
GetCurrentProcessId
OpenProcess
GetFileSize
ReadFile
lstrcmpW
DeleteFileW
SetEndOfFile
SetFilePointer
WriteFile
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetVersion
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
GetTempFileNameW
GetTempPathW
Sleep
ResumeThread
ResetEvent
GetLocalTime
IsBadReadPtr
lstrcpynW
lstrcpyW
GetLogicalDriveStringsW
QueryDosDeviceW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
K32GetModuleFileNameExW
K32GetProcessImageFileNameW
CreateMutexW
LocalFree
GetLongPathNameW
TerminateProcess
K32EnumProcesses
GetFileAttributesW
RemoveDirectoryW
SetFileAttributesW
GetWindowsDirectoryW
MoveFileW
MoveFileExW
CreateFileA
DeleteFileA
GetTempPathA
GetTempFileNameA
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
InitializeSListHead
FlushFileBuffers
WaitForSingleObjectEx
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
GetSystemWindowsDirectoryW
DeviceIoControl
lstrcmpA
RtlUnwind
ExitThread
GetModuleHandleExW

user32

GetWindowRect
GetCursorPos
CreateCaret
GetCaretBlinkTime
SetCaretPos
ScreenToClient
MapWindowPoints
IntersectRect
UnionRect
IsRectEmpty
PtInRect
GetWindowLongW
SetWindowLongW
GetParent
GetClassNameW
GetWindow
MonitorFromWindow
IsIconic
SetWindowRgn
MessageBoxW
GetMonitorInfoW
wsprintfW
DefWindowProcW
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
InvalidateRect
GetSystemMetrics
GetUpdateRect
SetPropW
GetPropW
LoadCursorW
LoadImageW
SystemParametersInfoW
wvsprintfW
SetCursor
InflateRect
OffsetRect
MonitorFromPoint
CharPrevW
DrawTextW
SetRect
DestroyIcon
DrawIconEx
GetIconInfo
GetMessagePos
MoveWindow
GetDlgCtrlID
DrawFocusRect
FillRect
HideCaret
ShowCaret
ClientToScreen
GetSysColor
GetWindowDC
GetWindowTextW
GetWindowTextLengthW
CreateAcceleratorTableW
InvalidateRgn
RemovePropW
FindWindowExW
IsWindowEnabled
EndPaint
BeginPaint
ReleaseDC
GetDC
KillTimer
SetTimer
ReleaseCapture
SetWindowTextW
PostQuitMessage
SetWindowPos
IsWindowVisible
ShowWindow
SetForegroundWindow
PostMessageW
SetCapture
GetKeyState
GetFocus
SetFocus
CharNextW
IsZoomed
UpdateLayeredWindow
DestroyWindow
IsChild
IsWindow
CreateWindowExW
SendMessageW
DispatchMessageW
TranslateMessage
GetClientRect
GetMessageW
EnableWindow

advapi32

RegCreateKeyW
RegCreateKeyExW
CloseServiceHandle
ControlService
DeleteService
OpenSCManagerW
OpenServiceW
RegDeleteValueW
RegQueryValueExW
RegCloseKey
RegSetValueExW
RegOpenKeyExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
GetTokenInformation
RegEnumKeyExW

shell32

ShellExecuteW
ord165
SHGetKnownFolderPath
SHFileOperationW
SHGetSpecialFolderPathW

ole32

OleLockRunning
CLSIDFromProgID
CLSIDFromString
CoCreateGuid
CreateStreamOnHGlobal
CoInitialize
CoCreateInstance
CoTaskMemFree
CoUninitialize

oleaut32

VariantClear
SafeArrayCreate
SafeArrayPutElement
SysAllocStringLen
SysAllocString
SysFreeString
VariantInit
SysStringLen

shlwapi

PathRemoveFileSpecW
PathCombineW
PathFileExistsW
StrStrIA
StrStrIW
PathFindFileNameW
PathAppendW
SHAutoComplete
wnsprintfW
StrTrimA
SHDeleteKeyW
SHSetValueW
PathFindFileNameA
PathRenameExtensionA
SHGetValueW
SHSetValueA
StrCmpIW
StrCmpNIW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

comctl32

ord17
_TrackMouseEvent
ImageList_DrawEx
InitCommonControlsEx
ImageList_GetIconSize

msimg32

AlphaBlend
GradientFill

gdiplus

GdipFree
GdipAlloc
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipCreatePath
GdipAddPathArcI
GdipCloneBrush
GdipDeleteBrush
GdipDeletePath
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipDrawLineI
GdipDrawRectangleI
GdipDrawPath
GdipFillEllipseI
GdipClosePathFigure
GdipCreateTexture
GdipCloneImage
GdipDisposeImage
GdipSetPenDashStyle
GdipAddPathLineI
GdiplusShutdown
GdiplusStartup
GdipSaveImageToFile
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipCreateSolidFill
GdipGetImageHeight
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipCreateHBITMAPFromBitmap
GdipCloneBitmapAreaI
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipSetInterpolationMode
GdipGraphicsClear
GdipFillPath
GdipDrawImagePointsI
GdipDrawImageRectRectI
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipLoadImageFromStreamICM
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipAddPathArc
GdipDrawEllipseI
GdipLoadImageFromFile
GdipGetImagePixelFormat
GdipDrawImageRectI

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

gdi32

ExtSelectClipRgn
SelectClipRgn
GetTextExtentPoint32W
SetBkColor
GetClipBox
GetCharABCWidthsW
CreateRectRgnIndirect
CombineRgn
GetDeviceCaps
CreateRoundRectRgn
SetWindowOrgEx
GetObjectW
SetBkMode
SelectObject
SaveDC
RestoreDC
Rectangle
GetStockObject
DeleteObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
GetDIBits
StretchBlt
SetStretchBltMode
SetTextColor
CreateDIBSection
SetDIBColorTable
TextOutW
ExtTextOutW
CreateSolidBrush
GetTextMetricsW
GetTextColor
SetDIBitsToDevice
CreateDCW

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 236KB - Virtual size: 235KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 576KB - Virtual size: 575KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

03944d6489d2d5a20dfc1026bb79c484

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

comctl32

msimg32

gdiplus

wininet

iphlpapi

urlmon

gdi32

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 236KB - Virtual size: 235KB

.data Size: 22KB - Virtual size: 51KB

.rsrc Size: 576KB - Virtual size: 575KB

.reloc Size: 65KB - Virtual size: 64KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 236KB - Virtual size: 235KB

.data
Size: 22KB - Virtual size: 51KB

.rsrc
Size: 576KB - Virtual size: 575KB

.reloc
Size: 65KB - Virtual size: 64KB