714b6375d1c11c8123e75fb0bfa83b005b60ce1889bcb7d7bac2c3573a4dd974

Sharing

Copy URL Twitter E-mail

General

Target

714b6375d1c11c8123e75fb0bfa83b005b60ce1889bcb7d7bac2c3573a4dd974
Size

768KB
MD5

71cd59ee5f12dfb8038e9fc95bbf9398
SHA1

de0ec6814a79370d62deb77272d13435f13f719c
SHA256

714b6375d1c11c8123e75fb0bfa83b005b60ce1889bcb7d7bac2c3573a4dd974
SHA512

57651a8dfd109bd23e49036b7cb22dfa6b1845c337130abfbea177a9c2061cf04d4054f74d45d3a7d98bee185604255464ce5b9990dd7f88011f90e3ffe6a9de
SSDEEP

12288:djNcROaO5hg92vhdElk1v3Hn2blTUN05ogFv6/oSz9pB5o:djJZ5hg9adElkh32blE05RvM5z9p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
714b6375d1c11c8123e75fb0bfa83b005b60ce1889bcb7d7bac2c3573a4dd974

Files

714b6375d1c11c8123e75fb0bfa83b005b60ce1889bcb7d7bac2c3573a4dd974
.dll windows:6 windows x64 arch:x64

bc97e837089044aecd881c62b9017b36

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

G:\My2024\2024练习代码\Black Desert\控制台_0408_02 - HF\bin\St_Library.pdb

Imports

kernel32

InitializeCriticalSectionEx
DeleteCriticalSection
GetModuleHandleA
GetPrivateProfileStringA
FreeLibrary
GetModuleFileNameA
GetProcAddress
LoadLibraryExA
FormatMessageA
VirtualAlloc
VirtualFree
CloseHandle
Sleep
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
ResumeThread
VirtualProtect
GetModuleHandleW
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
MultiByteToWideChar
WideCharToMultiByte
Process32First
Process32Next
GetProcessHeap
IsBadReadPtr
Beep
CreateThread
LoadResource
LockResource
SizeofResource
FindResourceA
GetTickCount
CreateProcessW
DuplicateHandle
ReadFile
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
InterlockedFlushSList
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
WriteConsoleW
SetEndOfFile
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
MoveFileExW
DeleteFileW
GetTimeZoneInformation
CreateFileW
CreatePipe
GetFileAttributesExW
GetExitCodeProcess
SetFilePointerEx
GetLastError
DecodePointer
OutputDebugStringA
GetFileSizeEx
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetTempPathW
GetFileType
GetStdHandle
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindNextFileW
FindFirstFileExW
FindClose
FreeLibraryAndExitThread
ExitThread
GetModuleFileNameW
QueryPerformanceFrequency
GetModuleHandleExW
EnterCriticalSection
LeaveCriticalSection
LocalFree
EncodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
RaiseException
SetLastError
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
WaitForSingleObject
GetLocalTime
GetVersionExA
GetLogicalDriveStringsA
GetProfileStringA
WriteProfileStringA
QueryDosDeviceA
GetComputerNameA
InitializeCriticalSection
SetEvent
CreateEventA
GetCurrentDirectoryA
CreateDirectoryA
CreateProcessA
GetSystemDirectoryA
RtlPcToFileHeader
RtlUnwindEx
ExitProcess

user32

PostMessageA
SetWindowTextA
PeekMessageA
IsWindowVisible
MessageBoxA
GetParent
GetTopWindow
GetWindowThreadProcessId
GetWindow
GetMessageA
GetMessageW
MessageBoxW
GetCursorPos
IsHungAppWindow
SendMessageTimeoutA
keybd_event
mouse_event
SetForegroundWindow
SendMessageA
SetWindowLongPtrA
GetWindowLongPtrA
CallWindowProcA

advapi32

RegCloseKey
RegCreateKeyExA
RegOpenKeyA
RegQueryValueExA
RegSetValueExA

winmm

PlaySoundA

ws2_32

WSACreateEvent
htonl
closesocket
connect
getpeername
htons
ntohl
recv
send
setsockopt
socket
WSASetLastError
WSAGetLastError
WSACloseEvent
select
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
getsockopt
ioctlsocket
WSACleanup
WSAWaitForMultipleEvents
ntohs
bind
inet_addr
recvfrom
sendto
WSAStartup

psapi

GetProcessImageFileNameA

ole32

CLSIDFromString
CoCreateGuid

oleaut32

SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocString
SysFreeString
VariantClear

Sections

.text
Size: 581KB - Virtual size: 580KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 143KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bc97e837089044aecd881c62b9017b36

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

winmm

ws2_32

psapi

ole32

oleaut32

Sections

.text Size: 581KB - Virtual size: 580KB

.rdata Size: 143KB - Virtual size: 142KB

.data Size: 7KB - Virtual size: 15KB

.pdata Size: 31KB - Virtual size: 30KB

.rsrc Size: 512B - Virtual size: 352B

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 581KB - Virtual size: 580KB

.rdata
Size: 143KB - Virtual size: 142KB

.data
Size: 7KB - Virtual size: 15KB

.pdata
Size: 31KB - Virtual size: 30KB

.rsrc
Size: 512B - Virtual size: 352B

.reloc
Size: 5KB - Virtual size: 4KB