de98e40456e984dac0e8d8f71a8db47850fe7d6731f0cec867befd446365b794

Sharing

Copy URL

Twitter E-mail

General

Target

de98e40456e984dac0e8d8f71a8db47850fe7d6731f0cec867befd446365b794
Size

4.5MB
MD5

0a26fdd19e75cbae337660b7a64978a2
SHA1

93a2bf31f20125b5994381ea08ac75822aa7ff1b
SHA256

de98e40456e984dac0e8d8f71a8db47850fe7d6731f0cec867befd446365b794
SHA512

83ddad0eb7f12ba8620024545fbc49ad9879e53ee52016403e275ed6887990280c6e23dd1b5eda654ae4a66782a08a3b4f9f84ce3e80f21049d9b92ab86c7c09
SSDEEP

98304:FcH8CCZCjGfIz15LlyHZNCB3skCjYzdapHw1:FcZCZCjiIzPLlyHZNCBckGpH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de98e40456e984dac0e8d8f71a8db47850fe7d6731f0cec867befd446365b794

Files

de98e40456e984dac0e8d8f71a8db47850fe7d6731f0cec867befd446365b794
.exe windows:6 windows x86 arch:x86

c05d01086bdbf2354e92d3d7109e129f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\david\Downloads\PVZFloral2\Release\LawnProject.pdb

Imports

kernel32

GetCurrentProcess
OutputDebugStringA
SetThreadPriority
InitializeCriticalSection
SetErrorMode
GetCurrentThreadId
Sleep
GetCurrentThread
GetVersionExA
GetThreadPriority
DeleteFileA
DeleteCriticalSection
VirtualQuery
GetWindowsDirectoryA
CreateMutexA
WaitForSingleObject
GetCommandLineA
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
WriteConsoleW
SetEndOfFile
HeapSize
RemoveDirectoryW
SetStdHandle
OutputDebugStringW
SetConsoleCtrlHandler
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
CreateDirectoryW
MoveFileExW
CreatePipe
GetFileAttributesExW
GetExitCodeProcess
HeapReAlloc
DeleteFileW
FlushFileBuffers
GetTimeZoneInformation
ReadConsoleW
SetFilePointerEx
VirtualProtect
GetConsoleMode
GetConsoleOutputCP
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapFree
HeapAlloc
GetCurrentDirectoryW
SetCurrentDirectoryW
SetEnvironmentVariableW
GetStdHandle
GetLocalTime
GetFullPathNameW
GetDriveTypeW
CreateProcessW
DuplicateHandle
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
InterlockedFlushSList
InterlockedPushEntrySList
RaiseException
RtlUnwind
GetCPInfo
CompareStringEx
GetStringTypeW
LCMapStringEx
GetLocaleInfoEx
LocalFree
DecodePointer
EncodePointer
CreateSymbolicLinkW
IsBadWritePtr
GetModuleFileNameA
GetFileTime
MulDiv
GetSystemDirectoryA
FileTimeToSystemTime
LeaveCriticalSection
EnterCriticalSection
SetUnhandledExceptionFilter
GetFileAttributesExA
CompareFileTime
GetFileSize
CreateFileA
FindClose
FindNextFileA
FindFirstFileA
GetModuleHandleA
FreeLibrary
GetProcAddress
LoadLibraryA
QueryPerformanceCounter
MapViewOfFile
QueryPerformanceFrequency
CreateFileMappingA
GetTickCount
MultiByteToWideChar
GetModuleFileNameW
lstrlenW
WaitNamedPipeW
ReadFile
GetCurrentProcessId
CloseHandle
GetLastError
CreateFileW
PeekNamedPipe
WriteFile
GetFileSizeEx
GetFileInformationByHandleEx
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
FreeLibraryWhenCallbackReturns
GetTickCount64
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
InitOnceExecuteOnce
InitializeCriticalSectionEx
GetTempPathW
SetFileInformationByHandle
WideCharToMultiByte
FormatMessageA
GetNativeSystemInfo
GetExitCodeThread
SwitchToThread
WaitForSingleObjectEx
TryAcquireSRWLockExclusive
WakeConditionVariable
InitializeSListHead
GetSystemTimeAsFileTime
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
SleepConditionVariableSRW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable

user32

ReleaseDC
GetClientRect
DrawTextExA
MoveWindow
EnumDisplaySettingsA
MessageBoxA
GetWindowInfo
OffsetRect
GetSystemMetrics
FillRect
GetDC
AdjustWindowRectEx
GetSysColorBrush
LoadIconA
TranslateMessage
LoadCursorA
SendMessageA
SetCursor
SetFocus
CreateWindowExA
DefWindowProcA
GetActiveWindow
ClientToScreen
RegisterClassA
HideCaret
GetCursor
SetCaretPos
CreateCaret
DestroyCaret
ShowCaret
DefWindowProcW
GetWindowRect
IsWindowVisible
EnumChildWindows
PostMessageA
ScreenToClient
EndDialog
GetClassNameA
WindowFromPoint
GetWindowPlacement
DestroyCursor
DialogBoxIndirectParamA
OpenClipboard
RegisterWindowMessageA
SetWindowLongA
CloseClipboard
EmptyClipboard
ChangeDisplaySettingsA
GetWindowLongA
CreateCursor
EnumWindows
GetClipboardData
SetCapture
SetClipboardData
SystemParametersInfoA
GetDlgItem
PeekMessageA
ReleaseCapture
SetForegroundWindow
IsIconic
SetCursorPos
GetCursorPos
BeginPaint
EndPaint
GetMessageA
DispatchMessageA
DestroyWindow
MessageBoxW
CreateWindowExW
ShowWindow
SetTimer
GetWindowTextA
SetWindowTextA
AdjustWindowRect

gdi32

CreateRectRgn
SelectClipRgn
GetTextExtentPoint32A
BitBlt
CreateFontA
SelectObject
CreateDIBSection
CreateCompatibleDC
StretchBlt
GdiFlush
GetStockObject
GetDeviceCaps
DeleteDC
SetTextColor
TextOutA
SetBkMode
Rectangle
CreateFontIndirectA
DeleteObject
GetTextMetricsA
GetObjectA
IntersectClipRect

advapi32

RegCreateKeyExA
RegEnumKeyA
RegOpenKeyA
RegDeleteKeyA
RegOpenKeyExA
RegDeleteValueA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW

shell32

ShellExecuteA

ole32

CoCreateInstance
CoInitialize

oleaut32

VariantChangeType
VariantInit
VariantClear
GetErrorInfo
SetErrorInfo
CreateErrorInfo
SysAllocString
SysFreeString

winmm

mixerGetControlDetailsA
mixerOpen
mixerGetLineInfoA
timeEndPeriod
timeGetTime
PlaySoundA
timeBeginPeriod
mixerClose
mixerSetControlDetails
mixerGetDevCapsA
mixerGetLineControlsA

ws2_32

send
WSACleanup
__WSAFDIsSet
WSAGetLastError
ioctlsocket
htons
recv
connect
socket
gethostbyname
inet_addr
WSAStartup
select
closesocket

Sections

.text
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 364KB - Virtual size: 363KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 54KB - Virtual size: 773KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 170KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c05d01086bdbf2354e92d3d7109e129f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

winmm

ws2_32

Sections

.text Size: 3.8MB - Virtual size: 3.8MB

.rdata Size: 364KB - Virtual size: 363KB

.data Size: 54KB - Virtual size: 773KB

.rsrc Size: 170KB - Virtual size: 169KB

.reloc Size: 109KB - Virtual size: 108KB

.text
Size: 3.8MB - Virtual size: 3.8MB

.rdata
Size: 364KB - Virtual size: 363KB

.data
Size: 54KB - Virtual size: 773KB

.rsrc
Size: 170KB - Virtual size: 169KB

.reloc
Size: 109KB - Virtual size: 108KB