46b5c2c970e5464721fecf64f27c95de0867bd5aa142f37fd1fe94bfaf7047d7[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

46b5c2c970e5464721fecf64f27c95de0867bd5aa142f37fd1fe94bfaf7047d7.exe
Size

29.9MB
MD5

57459d62203e11bab6d45fefa4df2646
SHA1

83c7fd1f4fb9a777f1a95d6156b8db7de40d5003
SHA256

46b5c2c970e5464721fecf64f27c95de0867bd5aa142f37fd1fe94bfaf7047d7
SHA512

197ade0086ee4e77f531b99cd27090a1f1500838c84e5255540ced72ac17073507cc06c0a281712f7f769d9ac18c8f93f36739fda8baa3159542c5ba1bd34928
SSDEEP

786432:bxtH4RWuCf7C/xC4Tg7ydaB8K+0RQQamk36mSY:4YuA+o4u0aGoWm6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
46b5c2c970e5464721fecf64f27c95de0867bd5aa142f37fd1fe94bfaf7047d7.exe

Files

46b5c2c970e5464721fecf64f27c95de0867bd5aa142f37fd1fe94bfaf7047d7.exe
.exe windows:6 windows x64 arch:x64

0063ead5d945629673dfd0f71c9e3122

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

gamedriver.pdb

Imports

kernel32

QueryPerformanceFrequency
CheckRemoteDebuggerPresent
SetThreadExecutionState
SetFilePointerEx
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
SwitchToThread
GetSystemInfo
GetStdHandle
GetConsoleMode
MultiByteToWideChar
WriteConsoleW
GetModuleHandleA
GetProcAddress
SetLastError
CreateWaitableTimerExW
SetWaitableTimer
Sleep
GetEnvironmentVariableW
GetModuleFileNameW
CreateFileW
SetFileInformationByHandle
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFullPathNameW
CreateDirectoryW
FindFirstFileW
FindClose
IsDebuggerPresent
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetExitCodeProcess
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
GetCurrentProcessId
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
ExitProcess
GetSystemTimePreciseAsFileTime
GetProcessTimes
OpenProcess
GetSystemTimes
GetProcessIoCounters
ReadProcessMemory
VirtualQueryEx
LocalFree
GlobalMemoryStatusEx
K32GetPerformanceInfo
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
WaitForSingleObject
GetCurrentProcess
GetTickCount64
GetComputerNameExW
GetLastError
CloseHandle
HeapAlloc
GetProcessHeap
HeapReAlloc
GetSystemDirectoryW
HeapFree
GetModuleHandleW

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WaitOnAddress
WakeByAddressSingle

ntdll

NtQueryInformationProcess
NtWriteFile
RtlNtStatusToDosError
RtlGetVersion
NtQuerySystemInformation

advapi32

IsValidSid
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
GetTokenInformation
OpenProcessToken
RegSetValueExW
SystemFunction036
GetLengthSid
CopySid
RegCloseKey

oleaut32

SysStringLen
SysAllocStringLen
SafeArrayDestroy
VariantClear
SysFreeString
SafeArrayAccessData
GetErrorInfo
SafeArrayUnaccessData

propsys

VariantToPropVariant
PropVariantToBSTR

ole32

PropVariantClear
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket

pdh

PdhOpenQueryA
PdhCollectQueryData
PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhRemoveCounter
PdhCloseQuery

bcrypt

BCryptGenRandom

shell32

ShellExecuteExW
CommandLineToArgvW

psapi

GetModuleFileNameExW

powrprof

CallNtPowerInformation

vcruntime140

memcmp
__current_exception_context
__current_exception
__C_specific_handler
memset
memmove
memcpy

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment
exit
_initterm_e
_exit
_initterm
_initialize_narrow_environment
_seh_filter_exe
__p___argc
terminate
_crt_atexit
__p___argv
_register_onexit_function
_initialize_onexit_table
_cexit
_set_app_type
_configure_narrow_argv
_register_thread_local_exe_atexit_callback
_c_exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Sections

.text
Size: 1023KB - Virtual size: 1023KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28.7MB - Virtual size: 28.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0063ead5d945629673dfd0f71c9e3122

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ntdll

advapi32

oleaut32

propsys

ole32

pdh

bcrypt

shell32

psapi

powrprof

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 1023KB - Virtual size: 1023KB

.rdata Size: 28.7MB - Virtual size: 28.7MB

.data Size: 113KB - Virtual size: 113KB

.pdata Size: 4KB - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 276B

.text
Size: 1023KB - Virtual size: 1023KB

.rdata
Size: 28.7MB - Virtual size: 28.7MB

.data
Size: 113KB - Virtual size: 113KB

.pdata
Size: 4KB - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 276B