TiagoModzPVP_Free[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

TiagoModzPVP_Free.exe
Size

13.4MB
MD5

8a530a749e1d47949123a57bc072b9d9
SHA1

d7b143d917666a01c40851b85bd9e447680f4f05
SHA256

4e6c751c98d7b2472a19ff18556feaae03c6ad78ff2dc72c2e71a20ecfe1147f
SHA512

f8b5166fac1aba4ac4eee7252f3379c5a5ba17e369fcd382effaad987f60e006324991bf1fa0c265c489a02f9b3bb1e60a5df653387ec9e8c0dc6c08a1f80f09
SSDEEP

196608:7+oJCtq3/h3V6GnjiaO51B6qW+HvemZ0x8dXV9W9nIiEPC6yu5r2HZVpCxgMQqIX:qsaa2GnO5GqWKveEEazYn/nuIHbsF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TiagoModzPVP_Free.exe

Files

TiagoModzPVP_Free.exe
.exe windows:6 windows x64 arch:x64

c4cbfe4a8386d532d13badaaadcbcd8e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CreateFileMappingW
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

user32

MessageBoxA

advapi32

CryptDestroyKey

shell32

ShellExecuteA

msvcp140

?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z

normaliz

IdnToAscii

wldap32

ord50

crypt32

CertFreeCertificateChain

ws2_32

closesocket

rpcrt4

UuidToStringA

psapi

GetModuleInformation

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-stdio-l1-1-0

fgetc

api-ms-win-crt-heap-l1-1-0

realloc

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe

api-ms-win-crt-math-l1-1-0

_dsign

api-ms-win-crt-filesystem-l1-1-0

_unlock_file

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-string-l1-1-0

tolower

api-ms-win-crt-time-l1-1-0

_gmtime64

api-ms-win-crt-utility-l1-1-0

qsort

Sections

.text
Size: - Virtual size: 511KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.*3L
Size: - Virtual size: 8.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Z4d
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.1|C
Size: 13.4MB - Virtual size: 13.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c4cbfe4a8386d532d13badaaadcbcd8e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

msvcp140

normaliz

wldap32

crypt32

ws2_32

rpcrt4

psapi

vcruntime140_1

vcruntime140

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

Sections

.text Size: - Virtual size: 511KB

.rdata Size: - Virtual size: 118KB

.data Size: - Virtual size: 5KB

.pdata Size: - Virtual size: 20KB

.*3L Size: - Virtual size: 8.0MB

.Z4d Size: 4KB - Virtual size: 4KB

.1|C Size: 13.4MB - Virtual size: 13.4MB

.rsrc Size: 512B - Virtual size: 469B

.text
Size: - Virtual size: 511KB

.rdata
Size: - Virtual size: 118KB

.data
Size: - Virtual size: 5KB

.pdata
Size: - Virtual size: 20KB

.*3L
Size: - Virtual size: 8.0MB

.Z4d
Size: 4KB - Virtual size: 4KB

.1|C
Size: 13.4MB - Virtual size: 13.4MB

.rsrc
Size: 512B - Virtual size: 469B