e6c71467196953b5216727b997c9795d42711a586791ae069e572e3cef922813N

Sharing

Copy URL Twitter E-mail

General

Target

e6c71467196953b5216727b997c9795d42711a586791ae069e572e3cef922813N
Size

9.1MB
MD5

d9906813055c18b0146d4661f98640f0
SHA1

aea7bc74c770dc2b0699c89b8a5d44c469f24ca1
SHA256

e6c71467196953b5216727b997c9795d42711a586791ae069e572e3cef922813
SHA512

e5b47d809513bac8008ecfee8847b26070a02375a848ec65880eec895544fc6b33889638af83d892d76a5d1bf1e7e57c09ec0489d361b94bf1d57b357083ad67
SSDEEP

49152:4k8E2qCycdubfayOuaMGPj2xa5clGgNiMf7m6amG2UFLV/KygfJsGMWNBiIBjeBj:EyOorGQJsGHQGsEPL+aObybur

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e6c71467196953b5216727b997c9795d42711a586791ae069e572e3cef922813N

Files

e6c71467196953b5216727b997c9795d42711a586791ae069e572e3cef922813N
.exe windows:6 windows x64 arch:x64

0aa4e4037ffb16150039f92ddce7959b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Roblox_assets_extractor.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WakeByAddressSingle
WaitOnAddress

opengl32

wglGetCurrentContext
wglGetProcAddress
wglDeleteContext
wglGetCurrentDC
wglShareLists
wglCreateContext
wglMakeCurrent

user32

SystemParametersInfoA
GetTouchInputInfo
ToUnicodeEx
MapVirtualKeyExW
GetKeyboardLayout
GetKeyState
SetWindowDisplayAffinity
InvalidateRgn
SetWindowPos
SetForegroundWindow
SendInput
PeekMessageW
TranslateMessage
DispatchMessageW
RedrawWindow
GetClientRect
MapVirtualKeyW
GetWindowTextW
GetWindowTextLengthW
SetWindowPlacement
ChangeDisplaySettingsExW
EnableMenuItem
GetSystemMenu
SetWindowTextW
MonitorFromPoint
ShowWindow
ReleaseDC
SetCapture
GetWindowLongPtrW
SetWindowLongPtrW
DefWindowProcW
CreateWindowExW
RegisterWindowMessageA
SetTimer
CloseTouchInputHandle
SetWindowLongW
KillTimer
GetMessageW
RegisterClassExW
GetKeyboardState
IsIconic
GetWindowLongW
AdjustWindowRectEx
IsProcessDPIAware
ScreenToClient
ClipCursor
MonitorFromRect
LoadCursorW
RegisterTouchWindow
GetClipCursor
ShowCursor
GetWindowRect
CreateIcon
DestroyIcon
DestroyWindow
GetSystemMetrics
CreateIconFromResourceEx
GetAsyncKeyState
RegisterRawInputDevices
GetRawInputData
ReleaseCapture
PostMessageW
SendMessageW
GetMenu
SetPropW
GetPropW
CallWindowProcW
RemovePropW
RegisterClipboardFormatW
EnumDisplayMonitors
SetClipboardData
CloseClipboard
IsClipboardFormatAvailable
OpenClipboard
EmptyClipboard
GetClipboardData
GetActiveWindow
FlashWindowEx
SetCursorPos
ClientToScreen
GetForegroundWindow
GetClassInfoExW
GetClassNameW
GetWindowPlacement
GetDC
ValidateRect
GetMonitorInfoW
GetCursorPos
MonitorFromWindow
SetCursor
TrackMouseEvent

ole32

CoCreateInstance
OleInitialize
RegisterDragDrop
CoInitializeEx
CoUninitialize
RevokeDragDrop

gdi32

DescribePixelFormat
DeleteObject
GetDeviceCaps
CreateRectRgn
ChoosePixelFormat
SwapBuffers
SetPixelFormat

dwmapi

DwmEnableBlurBehindWindow

kernel32

SetThreadErrorMode
GetModuleFileNameW
FreeLibrary
LoadLibraryW
GetProcAddress
LoadLibraryA
WaitForSingleObject
LoadLibraryExW
GetLastError
CloseHandle
GetCurrentThreadId
GetSystemTimeAsFileTime
GetProcessHeap
HeapAlloc
HeapFree
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
GlobalLock
SetUnhandledExceptionFilter
GlobalSize
GlobalUnlock
WaitForSingleObjectEx
GetFullPathNameW
CreateThread
WriteConsoleW
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
GetFileAttributesW
CreateProcessW
GetWindowsDirectoryW
GetSystemDirectoryW
ReadFileEx
CreateNamedPipeW
ExitProcess
GetModuleHandleW
GetConsoleMode
GlobalFree
GlobalAlloc
WideCharToMultiByte
MultiByteToWideChar
CreateMutexA
FormatMessageW
GetCurrentThread
FindFirstFileW
GetFileInformationByHandleEx
GetFileInformationByHandle
CreateFileW
FindClose
ReleaseMutex
lstrlenW
Sleep
GetModuleHandleA
HeapReAlloc
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
CreateWaitableTimerExW
SetWaitableTimer
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
QueryPerformanceFrequency
SetFileInformationByHandle
GetCurrentProcess
DuplicateHandle
GetExitCodeProcess
SleepEx
WriteFileEx
GetCurrentProcessId
GetStdHandle
IsProcessorFeaturePresent

shlwapi

AssocQueryStringW

advapi32

ImpersonateAnonymousToken
RevertToSelf

shell32

DragQueryFileW
DragFinish

oleaut32

SafeArrayPutElement
SafeArrayCreateVector
SetErrorInfo
SysStringLen
SysAllocStringLen
GetErrorInfo
SysFreeString

uiautomationcore

UiaReturnRawElementProvider
UiaGetReservedNotSupportedValue
UiaRaiseAutomationPropertyChangedEvent
UiaRaiseAutomationEvent
UiaLookupId
UiaHostProviderFromHwnd

uxtheme

SetWindowTheme

imm32

ImmSetCompositionWindow
ImmGetCompositionStringW
ImmGetContext
ImmAssociateContextEx
ImmSetCandidateWindow
ImmReleaseContext

ntdll

NtWriteFile
RtlNtStatusToDosError

vcruntime140

__current_exception
_CxxThrowException
__C_specific_handler
memset
__current_exception_context
memcpy
memcmp
__CxxFrameHandler3
memmove

api-ms-win-crt-math-l1-1-0

cbrtf
round
acosf
cosf
ceil
truncf
expf
_hypotf
sin
trunc
floorf
atan2f
cos
__setusermatherr
powf
ceilf
sinf
roundf
floor

api-ms-win-crt-string-l1-1-0

strlen
wcslen

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
__p___argc
__p___argv
_set_app_type
_seh_filter_exe
_initialize_narrow_environment
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
strerror
_cexit
_configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 5.8MB - Virtual size: 5.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 433KB - Virtual size: 433KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0aa4e4037ffb16150039f92ddce7959b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

opengl32

user32

ole32

gdi32

dwmapi

kernel32

shlwapi

advapi32

shell32

oleaut32

uiautomationcore

uxtheme

imm32

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 5.8MB - Virtual size: 5.8MB

.rdata Size: 2.9MB - Virtual size: 2.9MB

.data Size: 3KB - Virtual size: 3KB

.pdata Size: 433KB - Virtual size: 433KB

.reloc Size: 20KB - Virtual size: 19KB

.text
Size: 5.8MB - Virtual size: 5.8MB

.rdata
Size: 2.9MB - Virtual size: 2.9MB

.data
Size: 3KB - Virtual size: 3KB

.pdata
Size: 433KB - Virtual size: 433KB

.reloc
Size: 20KB - Virtual size: 19KB