8002e12377408dfff740a521c0da4fa7bd10b86d726e4fb7d142892484c73ff9N

Sharing

Copy URL Twitter E-mail

General

Target

8002e12377408dfff740a521c0da4fa7bd10b86d726e4fb7d142892484c73ff9N
Size

1.4MB
MD5

30106b40813d740acb0521614e316650
SHA1

bad8811a0a6ada1df8e12e822cbaf9cf2414685c
SHA256

8002e12377408dfff740a521c0da4fa7bd10b86d726e4fb7d142892484c73ff9
SHA512

0de217cb093287de6d37790a21a9bd48fc191f97d29a08289b3fd2021eefe9d41009427e2bfb82b2baa364e7aaf16f50639d3c01b2102a6044ab1556c6e66e18
SSDEEP

24576:AIMY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tLNiXicJFFRGNzj3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8002e12377408dfff740a521c0da4fa7bd10b86d726e4fb7d142892484c73ff9N

Files

8002e12377408dfff740a521c0da4fa7bd10b86d726e4fb7d142892484c73ff9N
.exe windows:6 windows x64 arch:x64

c37009ba3fc4db0cec9f59a95d7c7f22

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\code\app-player\out\winnt\x64\Release\hd\Source\Tool\ForceGPU\Release\HD-ForceGPU.pdb

Imports

advapi32

RegCreateKeyExW
RegSetValueExW
RegCloseKey

kernel32

lstrlenW
MultiByteToWideChar
WideCharToMultiByte
InitializeCriticalSection
FreeLibrary
GetProcAddress
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleA
Sleep
LocalFree
GetModuleHandleW
SetLastError
LoadLibraryExW
GetLastError
CreateProcessW
LocalAlloc
CreateProcessA
GetSystemDirectoryW
GetFullPathNameW
VerifyVersionInfoW
VerSetConditionMask
GetModuleFileNameW
CloseHandle
CreateFileW
lstrcmpA
OutputDebugStringW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStartupInfoW

msvcp140

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
_Mbrtowc
?uncaught_exceptions@std@@YAHXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

vcruntime140

__current_exception_context
__std_exception_destroy
memmove
_CxxThrowException
__current_exception
__std_type_info_destroy_list
__C_specific_handler
memset
__std_exception_copy
memcpy
memcmp
memchr
__std_terminate

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

exit
_exit
_initterm_e
__p___argc
__p___argv
_set_app_type
_c_exit
_initterm
_configure_narrow_argv
_seh_filter_exe
_get_initial_narrow_environment
_seh_filter_dll
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
terminate
_register_thread_local_exe_atexit_callback
_cexit
_initialize_narrow_environment
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-heap-l1-1-0

_callnewh
_set_new_mode
free
calloc
malloc

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode
__stdio_common_vfprintf
__stdio_common_vsprintf
__stdio_common_vsscanf
__acrt_iob_func

api-ms-win-crt-string-l1-1-0

wcstok
strncmp
tolower
toupper
isspace
isalpha
_wcsnicmp
_stricmp
strncpy

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c37009ba3fc4db0cec9f59a95d7c7f22

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 136KB - Virtual size: 135KB

.rdata Size: 14KB - Virtual size: 14KB

.data Size: 1KB - Virtual size: 7KB

.pdata Size: 5KB - Virtual size: 5KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1.2MB - Virtual size: 1.9MB

.text
Size: 136KB - Virtual size: 135KB

.rdata
Size: 14KB - Virtual size: 14KB

.data
Size: 1KB - Virtual size: 7KB

.pdata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1.2MB - Virtual size: 1.9MB