52b6544008f9e831b7de2b2dcaa5d3ec48be44df86b942774909a6886e906fbc

Sharing

Copy URL Twitter E-mail

General

Target

52b6544008f9e831b7de2b2dcaa5d3ec48be44df86b942774909a6886e906fbc
Size

1.0MB
MD5

7ff8480fffc5754ed956a1e043416ccb
SHA1

ef19563f425b9fcb608d0ea4eaea0592de9ef1bf
SHA256

52b6544008f9e831b7de2b2dcaa5d3ec48be44df86b942774909a6886e906fbc
SHA512

760a2a534e5b5549d7d6fc0b19ad007b6d07ea5f1e549c4117a5d37a4146f9009e9639442a0cb9d937ff84fe92ff7f9fb23730b3cf0210291c4c970c1856924b
SSDEEP

12288:RS7d8L3m1FJ93IqUGKvERZtfFrOMiFryIubMSpBFpBvmi:RS58Dm1FJnKMRZRNO/rxubMSpPLmi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
52b6544008f9e831b7de2b2dcaa5d3ec48be44df86b942774909a6886e906fbc

Files

52b6544008f9e831b7de2b2dcaa5d3ec48be44df86b942774909a6886e906fbc
.exe windows:6 windows x64 arch:x64

f9d6f9aff5833e39e2f6982e9978eb43

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

R:\proserwis-gaming-mode-cpp\GamingMode\x64\Release\GamingMode.pdb

Imports

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwindEx
NtSetTimerResolution
RtlPcToFileHeader
NtQueryTimerResolution
RtlUnwind

rpcrt4

UuidToStringW
RpcStringFreeW

powrprof

PowerReadFriendlyName
PowerEnumerate
PowerDeleteScheme
PowerGetActiveScheme
PowerSetActiveScheme
PowerDuplicateScheme
PowerImportPowerScheme

dwmapi

DwmEnableMMCSS

shlwapi

PathFileExistsW
PathAppendW

kernel32

lstrlenW
CreateMutexW
WaitForSingleObject
CreateEventW
Sleep
GetLastError
LoadLibraryW
CreateProcessW
GetModuleHandleW
SetPriorityClass
GetCurrentProcess
SizeofResource
WriteFile
TerminateProcess
CreateFileW
OpenProcess
LockResource
LoadResource
FindResourceW
Thread32Next
Thread32First
SuspendThread
ResumeThread
CreateThread
OpenThread
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetProcAddress
FreeLibrary
LocalAlloc
GetSystemDirectoryW
GetFileAttributesW
SetLastError
LoadLibraryExW
GetModuleFileNameA
VerifyVersionInfoW
VerSetConditionMask
GetFullPathNameW
CreateDirectoryW
FlsSetValue
FlsGetValue
FlsAlloc
HeapAlloc
HeapFree
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
Process32NextW
GetStdHandle
FreeLibraryAndExitThread
ExitThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
GetDriveTypeW
GetModuleHandleExW
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RaiseException
InitializeSListHead
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
DeleteFileW
FindClose
GetModuleFileNameW
FindNextFileW
FindFirstFileW
WideCharToMultiByte
LocalFree
CloseHandle
FlsFree
Process32FirstW
MultiByteToWideChar
CreateToolhelp32Snapshot
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadFile
ReadConsoleW
HeapReAlloc
SetStdHandle
GetTimeZoneInformation
WriteConsoleW
HeapSize
GetExitCodeProcess
GetCommandLineA
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetSystemTimeAsFileTime
GetCPInfo
IsValidCodePage
GetACP
SetEndOfFile
GetOEMCP
GetFileSizeEx
GetProcessHeap
CompareStringEx
LCMapStringEx
DecodePointer
GetEnvironmentStringsW
GetCommandLineW
EncodePointer
DeleteCriticalSection
InitializeCriticalSectionEx
FormatMessageA
GetStringTypeW
GetLocaleInfoEx
GetCurrentDirectoryW
FindFirstFileExW
GetFileAttributesExW
GetFileInformationByHandle
SetFileInformationByHandle
AreFileApisANSI
MoveFileExW
GetFileInformationByHandleEx
QueryPerformanceCounter
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetCurrentThreadId

user32

EnableWindow
EndPaint
DrawTextW
CreateWindowExW
GetWindowTextW
BeginPaint
GetWindowThreadProcessId
FindWindowA
DestroyIcon
GetMessageW
DefWindowProcW
CallWindowProcW
DestroyWindow
GetDC
MessageBoxW
SetWindowLongPtrW
FillRect
SendMessageW
GetSystemMetrics
GetWindowLongPtrW
DestroyCursor
ShowWindow
DispatchMessageW
RegisterClassW
ReleaseDC
IsDlgButtonChecked
SetFocus
TranslateMessage
LoadIconW
FindWindowW
LoadCursorW
SetCursor
GetClientRect
DrawIconEx
CheckDlgButton
PostQuitMessage
PtInRect
UpdateWindow
InvalidateRect
RegisterHotKey

gdi32

GetTextExtentPoint32W
SelectObject
CreateFontW
SetTextColor
SetBkMode
CreatePen
DeleteObject
CreateSolidBrush
RoundRect

advapi32

QueryServiceStatusEx
RegCloseKey
RegNotifyChangeKeyValue
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegDeleteValueW
ControlService
StartServiceW
ChangeServiceConfigW
RegOpenKeyExW
RegCreateKeyExW
RegEnumKeyExW
RegQueryValueExW
RegSetValueExW

shell32

SHGetFolderPathW

ole32

IIDFromString
StringFromGUID2

winhttp

WinHttpQueryDataAvailable
WinHttpConnect
WinHttpCloseHandle
WinHttpSetOption
WinHttpOpenRequest
WinHttpReadData
WinHttpQueryHeaders
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpReceiveResponse
WinHttpSendRequest

comctl32

ImageList_ReplaceIcon
ImageList_Draw
ImageList_Create
ImageList_Destroy
InitCommonControlsEx

wininet

InternetSetOptionW
InternetGetConnectedState

urlmon

URLDownloadToFileW

Sections

.text
Size: 496KB - Virtual size: 496KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 127KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 415KB - Virtual size: 414KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f9d6f9aff5833e39e2f6982e9978eb43

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

rpcrt4

powrprof

dwmapi

shlwapi

kernel32

user32

gdi32

advapi32

shell32

ole32

winhttp

comctl32

wininet

urlmon

Sections

.text Size: 496KB - Virtual size: 496KB

.rdata Size: 127KB - Virtual size: 127KB

.data Size: 8KB - Virtual size: 22KB

.pdata Size: 22KB - Virtual size: 21KB

.rsrc Size: 415KB - Virtual size: 414KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 496KB - Virtual size: 496KB

.rdata
Size: 127KB - Virtual size: 127KB

.data
Size: 8KB - Virtual size: 22KB

.pdata
Size: 22KB - Virtual size: 21KB

.rsrc
Size: 415KB - Virtual size: 414KB

.reloc
Size: 3KB - Virtual size: 3KB