6d6c1c062ec809b856e9f0d6e52dc970N

Sharing

Copy URL Twitter E-mail

General

Target

6d6c1c062ec809b856e9f0d6e52dc970N
Size

1.5MB
MD5

6d6c1c062ec809b856e9f0d6e52dc970
SHA1

35abef63a36f722c898cc95a474491e9d905de4a
SHA256

8b151aab9a356ca6336d7504cbef88494a066640dd261c2db2fe5cdce9b00f2c
SHA512

2e2e09b6b165c3104e4d93b43a0f41321e196cf0a0828cf6c4a9bf2cdd1c2f4da6b9040e33a2c0f76f80ffaa2c64e6133c39320a6764352488cb2c27947d8249
SSDEEP

12288:grGtUw7UbwviW8me3f8+K4ue61E1AsTwn4t9sjGIB1nWWcXlP7G:SGtUAUbLMevZesQ4+nOXVG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6d6c1c062ec809b856e9f0d6e52dc970N

Files

6d6c1c062ec809b856e9f0d6e52dc970N
.exe windows:10 windows x64 arch:x64

2a69d7432cce70de2672963579bd0d88

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

GameInputSvc.pdb

Imports

ntdll

RtlUnhandledExceptionFilter
RtlAllocateHeap
RtlGetVersion
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlInitUnicodeString
EtwEventWriteTransfer
NtTerminateProcess
swprintf_s
RtlFreeHeap
NtQueryLicenseValue
EtwEventUnregister
_wcsicmp
RtlAdjustPrivilege
LdrResSearchResource
_wcsnicmp
EtwEventRegister
wcscpy_s
VerSetConditionMask
towlower
memset

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
CreateEventW
OpenEventW
WaitForSingleObject
SetEvent

api-ms-win-core-errorhandling-l1-1-0

GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW
GetFileVersionInfoSizeW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-file-l1-1-0

GetFullPathNameW
CreateFileW
GetTempFileNameW
GetFileAttributesW
GetVolumePathNameW
DeleteFileW
SetFileAttributesW

api-ms-win-core-file-l2-1-0

CopyFileExW
MoveFileExW

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FreeLibrary
GetModuleFileNameW
GetProcAddress

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemDirectoryW

api-ms-win-core-wow64-l1-1-1

GetSystemWow64DirectoryW

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW
SetServiceStatus
StartServiceCtrlDispatcherW

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
TerminateProcess
GetCurrentProcess
CreateThread
GetExitCodeProcess
GetStartupInfoW
CreateProcessAsUserW

api-ms-win-security-base-l1-1-0

GetSecurityDescriptorSacl
AdjustTokenPrivileges
GetSecurityDescriptorOwner
DuplicateTokenEx
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
SetTokenInformation

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-kernel32-legacy-l1-1-0

WTSGetActiveConsoleSessionId
MoveFileW

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-security-provider-l1-1-0

GetNamedSecurityInfoW
SetNamedSecurityInfoW

ext-ms-win-session-wtsapi32-l1-1-0

WTSEnumerateSessionsW
WTSFreeMemory

crypt32

CertVerifyCertificateChainPolicy

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.sinit
Size: 4KB - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2a69d7432cce70de2672963579bd0d88

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-wow64-l1-1-1

api-ms-win-service-core-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-security-provider-l1-1-0

ext-ms-win-session-wtsapi32-l1-1-0

crypt32

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-errorhandling-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

wintrust

Sections

.text Size: 24KB - Virtual size: 23KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 4KB - Virtual size: 3KB

.pdata Size: 4KB - Virtual size: 720B

.sinit Size: 4KB - Virtual size: 32B

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 1.4MB - Virtual size: 1.4MB

.text
Size: 24KB - Virtual size: 23KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 4KB - Virtual size: 3KB

.pdata
Size: 4KB - Virtual size: 720B

.sinit
Size: 4KB - Virtual size: 32B

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 1.4MB - Virtual size: 1.4MB