f5ffb263cf510a2b51bc96743fcd2564f41e840e435e971c6d2bfb29838eccb2N

Sharing

Copy URL Twitter E-mail

General

Target

f5ffb263cf510a2b51bc96743fcd2564f41e840e435e971c6d2bfb29838eccb2N
Size

4.1MB
MD5

9193f858675e38eb2ecc352062b8f7f0
SHA1

bb861c5179b7fee09f6f1c0dad47bd9484e32290
SHA256

f5ffb263cf510a2b51bc96743fcd2564f41e840e435e971c6d2bfb29838eccb2
SHA512

13ab8dbefcc5fe7609ec39156d9da91fa53ee42bdcf7b32bd4aca7a91f4269b2e7f028c826bdb8fd20182702ab3da39f09abbef4f268ce3098cdb3144d92e15b
SSDEEP

1536:sHZ6brf5StUyDYK1xLTCjD2sTL0mk9KMYH4hMWnlo:sEX5tyDYKy/lct9KMYYCWK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f5ffb263cf510a2b51bc96743fcd2564f41e840e435e971c6d2bfb29838eccb2N

Files

f5ffb263cf510a2b51bc96743fcd2564f41e840e435e971c6d2bfb29838eccb2N
.dll windows:4 windows x86 arch:x86

81a18afd12750058ab827c52f20b874b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
LoadLibraryA
GetModuleHandleA
GetTickCount
VirtualProtect
GetPrivateProfileStringA
CloseHandle
VirtualFreeEx
ReadProcessMemory
OpenProcess
CreateThread
Sleep
DisableThreadLibraryCalls
SetEvent
WaitForSingleObject
CreateEventA

user32

GetWindowThreadProcessId
GetDesktopWindow
MessageBoxA

msvcr80

??3@YAXPAX@Z
sscanf_s
memset
??2@YAPAXI@Z
wcslen
memmove

Exports

Exports

OsThunkD3dContextCreate
OsThunkD3dContextDestroy
OsThunkD3dContextDestroyAll
OsThunkD3dDrawPrimitives2
OsThunkD3dValidateTextureStageState
OsThunkDdAddAttachedSurface
OsThunkDdAlphaBlt
OsThunkDdAttachSurface
OsThunkDdBeginMoCompFrame
OsThunkDdBlt
OsThunkDdCanCreateD3DBuffer
OsThunkDdCanCreateSurface
OsThunkDdColorControl
OsThunkDdCreateD3DBuffer
OsThunkDdCreateDirectDrawObject
OsThunkDdCreateMoComp
OsThunkDdCreateSurface
OsThunkDdCreateSurfaceEx
OsThunkDdCreateSurfaceObject
OsThunkDdDeleteDirectDrawObject
OsThunkDdDeleteSurfaceObject
OsThunkDdDestroyD3DBuffer
OsThunkDdDestroyMoComp
OsThunkDdDestroySurface
OsThunkDdEndMoCompFrame
OsThunkDdFlip
OsThunkDdFlipToGDISurface
OsThunkDdGetAvailDriverMemory
OsThunkDdGetBltStatus
OsThunkDdGetDC
OsThunkDdGetDriverInfo
OsThunkDdGetDriverState
OsThunkDdGetDxHandle
OsThunkDdGetFlipStatus
OsThunkDdGetInternalMoCompInfo
OsThunkDdGetMoCompBuffInfo
OsThunkDdGetMoCompFormats
OsThunkDdGetMoCompGuids
OsThunkDdGetScanLine
OsThunkDdLock
OsThunkDdLockD3D
OsThunkDdQueryDirectDrawObject
OsThunkDdQueryMoCompStatus
OsThunkDdReenableDirectDrawObject
OsThunkDdReleaseDC
OsThunkDdRenderMoComp
OsThunkDdResetVisrgn
OsThunkDdSetColorKey
OsThunkDdSetExclusiveMode
OsThunkDdSetGammaRamp
OsThunkDdSetOverlayPosition
OsThunkDdUnattachSurface
OsThunkDdUnlock
OsThunkDdUnlockD3D
OsThunkDdUpdateOverlay
OsThunkDdWaitForVerticalBlank
_OsThunkDdCreateFuckTencent@24
_OsThunkDdFuckTencent@0

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 316B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

81a18afd12750058ab827c52f20b874b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcr80

Exports

Exports

Sections

.text Size: 5KB - Virtual size: 5KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4.1MB - Virtual size: 4.1MB

.vmp0 Size: 66KB - Virtual size: 66KB

.reloc Size: 512B - Virtual size: 316B

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 5KB - Virtual size: 5KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4.1MB - Virtual size: 4.1MB

.vmp0
Size: 66KB - Virtual size: 66KB

.reloc
Size: 512B - Virtual size: 316B

.rsrc
Size: 1KB - Virtual size: 1KB