TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Static task
static1
1 signatures
General
-
Target
xtool.exe
-
Size
2.0MB
-
MD5
4559dc37a26a83c700b44c6b31ef83aa
-
SHA1
5fcf7c78226cd57d5a1aaa3bdc668bbc3182a9b7
-
SHA256
e576978963492e183780b2eafed1564753819cfb67977ddead61fad0873b1fc1
-
SHA512
5f0c4062135e369cba1e6b400bde9e3cfce415e9899724a2cddba4b50009901f2d50eefcad8c761cfc9f048a5e178453f05522549e2e20abe8993c4088a77927
-
SSDEEP
24576:hio617pAhrzJeKL9ODCkc5MO3kOuAmqw2UTvoaSM4hKp9w+xNLj4S5zlmXJuE1dV:hh+AHDs+dUTvoax432jMXJuE1dLB
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource xtool.exe
Files
-
xtool.exe.exe windows:5 windows x86 arch:x86
97c4c4dfededdd1c427425b22fc80bea
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetFileType
QueryDosDeviceW
GetACP
CloseHandle
LocalFree
SizeofResource
VirtualProtect
QueryPerformanceFrequency
IsDebuggerPresent
GetFullPathNameW
VirtualFree
GetProcessHeap
ExitProcess
HeapAlloc
GetCPInfoExW
RtlUnwind
GetCPInfo
EnumSystemLocalesW
GetStdHandle
SetStdHandle
FileTimeToLocalFileTime
GetModuleHandleW
FreeLibrary
HeapDestroy
ReadFile
HeapSize
GetLastError
GetModuleFileNameW
SetLastError
FindResourceW
CreateThread
CompareStringW
CopyFileW
MapViewOfFile
LoadLibraryA
ResetEvent
GetVolumeInformationW
FreeResource
GetDriveTypeW
GetVersion
RaiseException
MoveFileW
FormatMessageW
SwitchToThread
GetExitCodeThread
GetCurrentThread
GetFileAttributesExW
IsBadReadPtr
LoadLibraryExW
LockResource
FileTimeToSystemTime
GetCurrentThreadId
UnhandledExceptionFilter
VirtualQuery
VirtualQueryEx
Sleep
EnterCriticalSection
SetFilePointer
LoadResource
SuspendThread
GetTickCount
WritePrivateProfileStringW
GetFileSize
GetTempFileNameW
GetStartupInfoW
GetFileAttributesW
SetCurrentDirectoryW
InitializeCriticalSection
GetThreadPriority
GetCurrentProcess
SetThreadPriority
VirtualAlloc
GetCommandLineW
GetSystemInfo
GetTempPathW
LeaveCriticalSection
GetProcAddress
ResumeThread
GetLogicalDriveStringsW
GetVersionExW
VerifyVersionInfoW
HeapCreate
GetDiskFreeSpaceW
VerSetConditionMask
FindFirstFileW
GetUserDefaultUILanguage
GetConsoleOutputCP
UnmapViewOfFile
GetConsoleCP
lstrlenW
SetEndOfFile
QueryPerformanceCounter
HeapFree
WideCharToMultiByte
FindClose
MultiByteToWideChar
LoadLibraryW
SetEvent
GetLocaleInfoW
CreateFileW
DeleteFileW
IsDBCSLeadByteEx
GetLocalTime
WaitForSingleObject
WriteFile
CreateFileMappingW
ExitThread
DeleteCriticalSection
GetDateFormatW
TlsGetValue
IsValidLocale
TlsSetValue
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
RemoveDirectoryW
CreateEventW
GetPrivateProfileStringW
SetThreadLocale
GetThreadLocale
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
user32
CharUpperBuffW
CharNextW
MsgWaitForMultipleObjects
CharLowerBuffW
LoadStringW
CharUpperW
PeekMessageW
GetSystemMetrics
MessageBoxW
oleaut32
SysAllocStringLen
SafeArrayPtrOfIndex
VariantCopy
SafeArrayGetLBound
SafeArrayGetUBound
VariantInit
VariantClear
SysFreeString
SysReAllocStringLen
VariantChangeType
SafeArrayCreate
msvcrt
memcpy
netapi32
NetWkstaGetInfo
NetApiBufferFree
advapi32
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
Exports
Exports
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 121KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 24KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didata Size: 1024B - Virtual size: 534B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 151B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 32B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 93B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 824KB - Virtual size: 824KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ