33f732793ab4bf584e843b921122dbfc92d2017e6b07758c6b4119d34a389650

Sharing

Copy URL Twitter E-mail

General

Target

33f732793ab4bf584e843b921122dbfc92d2017e6b07758c6b4119d34a389650
Size

394KB
MD5

78027fc67b06851223c13def07c4abd3
SHA1

8a366657e2bcc3280ae58fdfa1088a5bd655c7a1
SHA256

33f732793ab4bf584e843b921122dbfc92d2017e6b07758c6b4119d34a389650
SHA512

ca7d07c6bf723644158dd345a9582ac6112d5907aedf4c2f13e49bd477d962dfa8c830adadecc3ce3d1426a0bf0c8a194c0ac36f85ca95c32d57d5108ff853a2
SSDEEP

6144:e/tGvR6jAvLYCfNdrVD49mkqjLeM4ZWhdR/WQy5tjQ4qqcLpH0:eMpvDNA9mkqJzhdR/da0LpH0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
33f732793ab4bf584e843b921122dbfc92d2017e6b07758c6b4119d34a389650

Files

33f732793ab4bf584e843b921122dbfc92d2017e6b07758c6b4119d34a389650
.dll windows:6 windows x86 arch:x86

02c070dae0519c1a38259cfc7d6dc78e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

rust_dave_sideload.pdb

Imports

kernel32

GetNativeSystemInfo
VirtualQuery
VirtualFree
VirtualProtect
GetSystemInfo
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
HeapSize
GetProcAddress
FreeEnvironmentStringsW
GetLastError
SetThreadStackGuarantee
CreateWaitableTimerExW
SetWaitableTimer
WaitForSingleObject
Sleep
QueryPerformanceCounter
GetModuleHandleA
GetCurrentProcess
GetCurrentThread
RtlCaptureContext
ReleaseMutex
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetStringTypeW
GetCommandLineW
FlushFileBuffers
SetFileInformationByHandle
SetFilePointerEx
SetStdHandle
GetConsoleOutputCP
WriteFile
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetStdHandle
GetCurrentProcessId
SetHandleInformation
TerminateProcess
CloseHandle
VirtualAlloc
HeapFree
LCMapStringW
HeapReAlloc
WaitForSingleObjectEx
LoadLibraryA
lstrlenW
CreateMutexA
GetProcessHeap
HeapAlloc
FindNextFileW
FindClose
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
ReadFile
GetModuleHandleExW
GetConsoleMode
GetFileType
LoadLibraryExW
FreeLibrary
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
ReadConsoleW
CreateThread
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
TlsGetValue
TlsSetValue
GetFullPathNameW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
InterlockedFlushSList
RaiseException
RtlUnwind
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
DecodePointer

ws2_32

listen
WSAStartup
getaddrinfo
WSASocketW
WSAGetLastError
closesocket
freeaddrinfo
bind
WSACleanup

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WakeByAddressAll
WaitOnAddress

ntdll

RtlNtStatusToDosError
NtReadFile
NtWriteFile

Exports

Exports

DllMain
g2mchat_winmain
g2mcomm_winmain
g2mfeedback_winmain
g2mhost_winmain
g2minstaller_winmain
g2minsthigh_winmain
g2mlauncher_winmain
g2mmatchmaking_winmain
g2mmaterials_winmain
g2mpolling_winmain
g2mqanda_winmain
g2mrecorder_winmain
g2msessioncontrol_winmain
g2mstart_winmain
g2mtesting_winmain
g2mtranscoder_winmain
g2mui_winmain
g2muninstall_winmain
g2mvideoconference_winmain
g2mview_winmain

Sections

.text
Size: 222KB - Virtual size: 221KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 80KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

02c070dae0519c1a38259cfc7d6dc78e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ws2_32

api-ms-win-core-synch-l1-2-0

ntdll

Exports

Exports

Sections

.text Size: 222KB - Virtual size: 221KB

.rdata Size: 75KB - Virtual size: 75KB

.data Size: 80KB - Virtual size: 82KB

.reloc Size: 15KB - Virtual size: 14KB

.text
Size: 222KB - Virtual size: 221KB

.rdata
Size: 75KB - Virtual size: 75KB

.data
Size: 80KB - Virtual size: 82KB

.reloc
Size: 15KB - Virtual size: 14KB