0f2834575952710b7dbe8a4b407c091bcdf6af501995c262cb528c59f4fd2b27

Sharing

Copy URL Twitter E-mail

General

Target

0f2834575952710b7dbe8a4b407c091bcdf6af501995c262cb528c59f4fd2b27
Size

4.0MB
MD5

dee07a8b7c67649dfb8a45207c58055c
SHA1

cd3e41e36a518808d580a8ac99d122e13bd9a690
SHA256

0f2834575952710b7dbe8a4b407c091bcdf6af501995c262cb528c59f4fd2b27
SHA512

8c61a80f9de6e5b76953576a6cc65b168db76bb26749e4e1b5c27bcc5665797d75ef2e8293aea407242af5e0988b50be0abe85c09aeb919a274a84b27e1cb89e
SSDEEP

49152:xTgXsPpzLrqANTXp9DfEtwc+oGPTTv/Atb2DPL7gca2Fb1zloPAb:tgUlnTXffEXv2DvVfFbgPAb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f2834575952710b7dbe8a4b407c091bcdf6af501995c262cb528c59f4fd2b27

Files

0f2834575952710b7dbe8a4b407c091bcdf6af501995c262cb528c59f4fd2b27
.exe windows:4 windows x86 arch:x86

81d288081a91928e526ab9235011e1f7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathUnquoteSpacesA
PathRemoveArgsA
PathRemoveFileSpecA
PathAddBackslashA
PathStripPathA

kernel32

CreateFileA
GetLastError
ReadFile
WriteFile
CloseHandle
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetFileSize
LeaveCriticalSection
EnterCriticalSection
Sleep
GetCommandLineA
GetLocalTime
FileTimeToSystemTime
FindClose
SetFilePointer
CreateDirectoryA
RemoveDirectoryA
FindNextFileA
DeleteFileA
FindFirstFileA
GetOverlappedResult
GetTickCount
GlobalFree
GetCommandLineW
SetEvent
ResetEvent
TryEnterCriticalSection
CreateThread
QueryPerformanceFrequency
WaitForSingleObject
SetEndOfFile
GetProcessHeap
lstrcmpiA
GetFullPathNameA
InterlockedCompareExchange
UnmapViewOfFile
CreateFileW
CreateFileMappingA
MapViewOfFile
IsProcessorFeaturePresent
GetLocaleInfoW
SetStdHandle
LoadLibraryA
IsBadCodePtr
IsBadReadPtr
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
MultiByteToWideChar
OutputDebugStringA
QueryPerformanceCounter
CreateEventA
InterlockedIncrement
GetStringTypeA
VirtualQuery
GetSystemInfo
VirtualProtect
GetLocaleInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
RtlUnwind
ExitProcess
RaiseException
HeapAlloc
HeapFree
HeapReAlloc
GetModuleHandleA
GetStartupInfoA
GetVersionExA
LCMapStringA
WideCharToMultiByte
LCMapStringW
GetCPInfo
GetProcAddress
TerminateProcess
GetCurrentProcess
HeapSize
TlsAlloc
SetLastError
GetCurrentThreadId
TlsFree
TlsSetValue
TlsGetValue
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
SetUnhandledExceptionFilter
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
FlushFileBuffers
GetACP
GetOEMCP
GetStdHandle
UnhandledExceptionFilter

user32

GetKeyboardState
SetRect
GetClientRect
MessageBoxA
DefWindowProcA
ScreenToClient
SetCursor
keybd_event
PostThreadMessageA
MsgWaitForMultipleObjects
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
GetForegroundWindow
GetWindowLongA
GetParent
RegisterClassA
CreateWindowExA
ShowWindow
UpdateWindow
DestroyWindow
UnregisterClassA

shell32

CommandLineToArgvW

ole32

CoUninitialize
CoCreateInstance
CoInitialize

d3d9

Direct3DCreate9

dinput8

DirectInput8Create

dsound

ord11
ord2

binkw32

_BinkDoFrame@4
_BinkOpen@8
_BinkSetSoundTrack@8
_BinkSetVolume@12
_BinkOpenDirectSound@4
_BinkSetSoundSystem@8
_BinkNextFrame@4
_BinkCopyToBuffer@28
_BinkWait@4
_BinkClose@4

gdi32

DeleteObject

advapi32

RegOpenKeyA
RegQueryValueExA
RegCloseKey

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 700KB - Virtual size: 697KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 336KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

81d288081a91928e526ab9235011e1f7

Headers

File Characteristics

Imports

shlwapi

kernel32

user32

shell32

ole32

d3d9

dinput8

dsound

binkw32

gdi32

advapi32

Sections

.text Size: 2.9MB - Virtual size: 2.9MB

.rdata Size: 700KB - Virtual size: 697KB

.data Size: 336KB - Virtual size: 1.3MB

.rsrc Size: 8KB - Virtual size: 8KB

.text
Size: 2.9MB - Virtual size: 2.9MB

.rdata
Size: 700KB - Virtual size: 697KB

.data
Size: 336KB - Virtual size: 1.3MB

.rsrc
Size: 8KB - Virtual size: 8KB