985f30ae561b0e7991598426f45be024351e5a58f017265bdf1192fddc918369

Sharing

Copy URL Twitter E-mail

General

Target

985f30ae561b0e7991598426f45be024351e5a58f017265bdf1192fddc918369
Size

37KB
MD5

63ba486576c82769425b47a40e35b28a
SHA1

e7cd13cb79bfd7a253d7ca5faedda2e4e7b3f811
SHA256

985f30ae561b0e7991598426f45be024351e5a58f017265bdf1192fddc918369
SHA512

a7afad0ac0cb4f3de841d37230bbdd1243c1da0f151eb3b0f07bd810cec7134fb45c73165f58f697f2a13f2bfebe42388e763d35f3d259a17366fd07b6b01869
SSDEEP

768:9ujUa6tOHkULDSNXNq3qIWxMHkp3WgdoovKJsxSSMFmNvupeoy:U4OHbwyWxgkFWooovKJsgSMF4Wpeo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
985f30ae561b0e7991598426f45be024351e5a58f017265bdf1192fddc918369

Files

985f30ae561b0e7991598426f45be024351e5a58f017265bdf1192fddc918369
.exe windows:5 windows x86 arch:x86

727b6b266cfeb0e724b4e41475d248e9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\landun\p-86b4bd8fbe654546b82b35d58337baa8\VNDesktop2\VideoNativeDesktop\HummerSDK\Output\PdbFinal\PluginContainer.pdb

Imports

common

?GetSession@TXLog@@YAKXZ
?GetLCID@NLS@@YAKXZ
?SetBugReportFlag@TXBugReport@@YAHK@Z
?SetBugReportUin@TXBugReport@@YAXKH@Z
?ValidateBugReport@TXBugReport@@YAXXZ
?FlushLog@TXLog@@YAXXZ
?AddExtraMem@TXBugReport@@YAHKI@Z
?SaveCallStack@Misc@Util@@YAEEPAKEHK@Z
?GetString@CTXStringW@@QBEPB_WXZ
?GetCallStack@Misc@Util@@YA?AVCTXStringW@@EEPB_W@Z
?GetBuffer@CTXStringW@@QAEPA_WH@Z
?AppendFormat@CTXStringW@@QAAXPB_WZZ
??H@YA?AVCTXStringW@@PB_WABV0@@Z
??0CTXStringW@@QAE@ABV0@@Z
?Format@CTXStringW@@QAAXPB_WZZ
?GetLength@CTXStringW@@QBEHXZ
?ReleaseBuffer@CTXStringW@@QAEXH@Z
??ACTXStringW@@QBE_WH@Z
??0CTXStringW@@QAE@PB_W@Z
?Append@CTXStringW@@QAEXPB_W@Z
??YCTXStringW@@QAEAAV0@ABV0@@Z
??YCTXStringW@@QAEAAV0@PB_W@Z
??BCTXStringW@@QBEPB_WXZ
??1CTXStringW@@QAE@XZ
??4CTXStringW@@QAEAAV0@PB_W@Z
?GetExeDir@Sys@Util@@YA?AVCTXStringW@@XZ
?SafeLoadLibrary@Sys@Util@@YAPAUHINSTANCE__@@PB_W@Z
??0CTXStringW@@QAE@XZ
?InitBugReport@TXBugReport@@YAXPB_W000GGKHHKKP6GHPAUtagBugReportInfo@1@PBD200PAPAXPAKPAX@Z@Z
?DetourRemoveWrapper@Misc@Util@@YAHPAE0@Z
?DetourFunctionWrapper@Misc@Util@@YAXPAE0PAPAE@Z
?Mid@CTXStringW@@QBE?AV1@H@Z
?ReverseFind@CTXStringW@@QBEH_W@Z
??H@YA?AVCTXStringW@@ABV0@PB_W@Z
??4CTXStringW@@QAEAAV0@ABV0@@Z
?Left@CTXStringW@@QBE?AV1@H@Z
??8@YA_NABVCTXStringW@@PB_W@Z
?ClearDeadQueue@Misc@Util@@YAXXZ
?OnExitWinMain@Misc@Util@@YAXXZ
?TXLog_DoTXLogVW@@YAXPAUtagLogObj@@PB_W1PAD@Z
??8@YA_NPB_WABVCTXStringW@@@Z
??0CTXStringW@@QAE@PA_W@Z
?SetMainAndLogicThreadId@Misc@Util@@YAXKK@Z
?SetMainAndLogicMsgLoop@Misc@Util@@YAXPAVMessageLoopForUI@AsyncTask@@PAVMessageLoop@4@@Z
?MinimzeMemory@Sys@Util@@YAXXZ

processsession

??0CTXOPChannel@@QAE@XZ
?AddSink@CTXOPChannel@@QAEXPAUITXOPChanelSysSink@@@Z
?Run@CTXOPChannel@@EAEIXZ
?GetConnectCount@CTXOPChannel@@QAEIXZ
?SendReply@CTXOPChannel@@QAEHKKPBEI@Z
??1CTXOPChannel@@UAE@XZ
?Start@CTXOPChannel@@QAEHPB_W@Z
?Listen@CTXOPChannel@@QAEHXZ

wininet

InternetErrorDlg

asynctask

?Release@Lock@AsyncTask@@QAEXXZ
?Acquire@Lock@AsyncTask@@QAEXXZ
?Run@MessageLoopForUI@AsyncTask@@QAEXXZ
??1MessageLoopForUI@AsyncTask@@UAE@XZ
??0MessageLoopForUI@AsyncTask@@QAE@XZ
??1AtExitManager@AsyncTask@@QAE@XZ
??0AtExitManager@AsyncTask@@QAE@XZ
??1Thread@AsyncTask@@UAE@XZ
??0Thread@AsyncTask@@QAE@PBD@Z
?RegisterCallback@AtExitManager@AsyncTask@@SAXP6AXPAX@Z0@Z
??0Lock@AsyncTask@@QAE@XZ
??1Lock@AsyncTask@@QAE@XZ
?StartWithOptions@Thread@AsyncTask@@QAE_NABUOptions@12@@Z

kernel32

OutputDebugStringW
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
SetErrorMode
GetTickCount
SetUnhandledExceptionFilter
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetModuleFileNameW
GetProcAddress
OpenMutexW
CloseHandle
CreateMutexW
GetTempPathW
CreateDirectoryW
CreateFileW
GetCurrentProcess
TerminateProcess
GetModuleHandleExW
lstrlenW
GetLastError
SetLastError
DebugBreak
TlsGetValue
HeapAlloc
GetProcessHeap
TlsSetValue
InterlockedExchange
TlsAlloc
FreeLibrary
WriteProcessMemory
InterlockedDecrement
GetSystemDirectoryW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitializeSListHead
IsDebuggerPresent

user32

SetTimer
KillTimer
PostQuitMessage

advapi32

RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
GetUserNameW
RegCloseKey

shell32

ShellExecuteW

ole32

CoInitialize
OleUninitialize
OleInitialize
CoUninitialize
CoCreateInstance
CLSIDFromProgID

msvcp140

?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z

vcruntime140

__CxxFrameHandler3
memcmp
wcsrchr
memset
memcpy
memmove
_purecall
wcsstr
_except_handler4_common
__std_exception_copy
__std_exception_destroy
_CxxThrowException

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_register_onexit_function
_controlfp_s
_crt_atexit
_cexit
__p___wargv
__p___argc
_seh_filter_exe
_set_app_type
_invalid_parameter_noinfo_noreturn
_configure_wide_argv
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
terminate
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_wide_environment

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-string-l1-1-0

strlen
wcscmp
wcscpy_s
wcslen

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode
__stdio_common_vswscanf

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
_set_new_mode
free

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

727b6b266cfeb0e724b4e41475d248e9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

common

processsession

wininet

asynctask

kernel32

user32

advapi32

shell32

ole32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 17KB - Virtual size: 17KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 512B - Virtual size: 1KB

.gfids Size: 512B - Virtual size: 80B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 17KB - Virtual size: 17KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 512B - Virtual size: 1KB

.gfids
Size: 512B - Virtual size: 80B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB