5ef3fd9a44df55791854a1cf4850f47229a83c45872918559b6186ece78e81c1

Sharing

Copy URL Twitter E-mail

General

Target

5ef3fd9a44df55791854a1cf4850f47229a83c45872918559b6186ece78e81c1
Size

1.7MB
MD5

efbe020faef08a9cfe4e7bd7a7e8450e
SHA1

2f0fa0150d6be0b03a3eef5dbf99cf60fddda723
SHA256

5ef3fd9a44df55791854a1cf4850f47229a83c45872918559b6186ece78e81c1
SHA512

0164abad0ae1b60b0f1602fa2f46a8c3419cf71fd1f8b46ab34b9765831d1508783e81b640ce8eb23e09acb529ab4930590f85954ecf3df045fc08d8e7462d8c
SSDEEP

49152:ojHy6M/Eki495VnHSGgyMP90FpRubImnwd:GUH2XPU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5ef3fd9a44df55791854a1cf4850f47229a83c45872918559b6186ece78e81c1

Files

5ef3fd9a44df55791854a1cf4850f47229a83c45872918559b6186ece78e81c1
.dll windows:6 windows x64 arch:x64

5be459a445a53d5f135dd0c3d2718c10

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

swqols.pdb

Imports

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressAll
WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

GetProcessHeap
LoadLibraryExA
GetSystemTimeAsFileTime
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Thread32Next
Thread32First
SetThreadContext
GetThreadContext
ResumeThread
SuspendThread
OpenThread
GetCurrentThreadId
GetCurrentProcessId
Sleep
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
HeapCreate
GetLastError
LoadLibraryA
FreeLibraryAndExitThread
GetProcAddress
GetModuleHandleA
WaitForSingleObjectEx
FreeConsole
FormatMessageW
GetConsoleMode
GetStdHandle
SetThreadStackGuarantee
GetCurrentThread
SwitchToThread
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
SetFileInformationByHandle
K32GetModuleInformation
GetModuleHandleW
CreateToolhelp32Snapshot
IsProcessorFeaturePresent
FlushInstructionCache
GetCurrentProcess
TerminateProcess
QueryPerformanceFrequency
UnmapViewOfFile
IsDebuggerPresent
lstrlenW
ReleaseMutex
MapViewOfFile
CreateFileMappingW
FindClose
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
FindFirstFileW
GetSystemInfo
VirtualProtect
VirtualFree
GetFullPathNameW
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
CreateThread
VirtualAlloc
VirtualQuery
GetNativeSystemInfo
CloseHandle
CreateMutexA
WaitForSingleObject

user32

DefWindowProcW
CallWindowProcW
MapVirtualKeyW
GetKeyState
GetRawInputData
GetClientRect
WindowFromDC
SetWindowLongPtrW

opengl32

wglGetProcAddress

oleaut32

SysStringLen
SysFreeString

ntdll

RtlNtStatusToDosError
NtReadFile
NtWriteFile

vcruntime140

memchr
__std_type_info_destroy_list
__C_specific_handler
_CxxThrowException
__CxxFrameHandler3
memcpy
memmove
memcmp
memset
strstr

api-ms-win-crt-math-l1-1-0

logf
sqrtf
sinf
powf
pow
log
fmodf
cosf
ceilf
acosf
fmod

api-ms-win-crt-string-l1-1-0

strncmp
strncpy
strcmp

api-ms-win-crt-runtime-l1-1-0

_cexit
_execute_onexit_table
_wassert
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm

api-ms-win-crt-stdio-l1-1-0

fflush
fread
__acrt_iob_func
fseek
ftell
fwrite
__stdio_common_vfprintf
__stdio_common_vsprintf
fclose
fopen
__stdio_common_vsscanf

api-ms-win-crt-heap-l1-1-0

free
malloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atof

Exports

Exports

DllMain
custom_fade
custom_speed
editor_destructor_hook
hook_ctrl_click
safety_check
update_quaternion_hook

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 383KB - Virtual size: 382KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5be459a445a53d5f135dd0c3d2718c10

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

user32

opengl32

oleaut32

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 383KB - Virtual size: 382KB

.data Size: 3KB - Virtual size: 11KB

.pdata Size: 56KB - Virtual size: 56KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 383KB - Virtual size: 382KB

.data
Size: 3KB - Virtual size: 11KB

.pdata
Size: 56KB - Virtual size: 56KB

.reloc
Size: 5KB - Virtual size: 5KB