5fd0ec00efd7ef42dc23bf49a36b73180447f00547ec5274f7936b3c5c781872N

Sharing

Copy URL Twitter E-mail

General

Target

5fd0ec00efd7ef42dc23bf49a36b73180447f00547ec5274f7936b3c5c781872N
Size

354KB
MD5

6a84288cc78bdb0c0527723b60b346b0
SHA1

3369161a0bc31b013f7fa8a61127324bd42b79d5
SHA256

5fd0ec00efd7ef42dc23bf49a36b73180447f00547ec5274f7936b3c5c781872
SHA512

35710fe6f6cb43866aef68719ea6a34071c3adb74141ea221d35b09fc9442db3c23114d5330fdfcb2930fac9f7dfae35f3bfbb3a18ac80b37f04a9772ee03bac
SSDEEP

6144:PPvelzlEZOjeCyZPtaKAohHM72GRuTzCuWr/o+9:62ZOoTAohHM7NRLhD9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5fd0ec00efd7ef42dc23bf49a36b73180447f00547ec5274f7936b3c5c781872N

Files

5fd0ec00efd7ef42dc23bf49a36b73180447f00547ec5274f7936b3c5c781872N
.dll windows:6 windows x86 arch:x86

e433b76f910d75d82591c2f2e363b808

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Sources\foobar2000-2.1\foobar2000\Release\foo_fileops.pdb

Imports

kernel32

MultiByteToWideChar
GetCurrentThread
OutputDebugStringW
GetVolumePathNameW
CreateHardLinkW
GetTickCount64
WaitForSingleObject
CloseHandle
GlobalSize
GlobalUnlock
CreateEventW
SetEvent
ResetEvent
GlobalLock
GlobalAlloc
GlobalFree
LoadLibraryExW
GetTickCount
lstrlenW
VerSetConditionMask
VerifyVersionInfoW
GetVersionExW
GetProcAddress
GetModuleHandleW
GetThreadPriority
SetThreadPriority
ResumeThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
IsDebuggerPresent
GetCurrentProcess
GetSystemTimeAsFileTime
InitOnceBeginInitialize
InitOnceComplete
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
DecodePointer
LoadLibraryExA
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
DisableThreadLibraryCalls
TerminateProcess
MoveFileExW
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
VirtualFree
HeapDestroy
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
RaiseException
MulDiv
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
InitializeCriticalSectionEx
DeleteCriticalSection
GetLastError
GetFileAttributesW
SetLastError

user32

SystemParametersInfoW
ScrollWindowEx
SetScrollPos
EnumThreadWindows
IsWindowVisible
UpdateWindow
SetScrollInfo
SetRectEmpty
SetGestureConfig
GetWindowPlacement
IsIconic
MonitorFromRect
CloseGestureInfoHandle
GetGestureInfo
GetMenu
GetClipboardData
CloseClipboard
OpenClipboard
AdjustWindowRect
MapWindowPoints
OffsetRect
RegisterWindowMessageW
DrawEdge
AdjustWindowRectEx
MapDialogRect
IsZoomed
FillRect
EndDeferWindowPos
GetDC
DeferWindowPos
GetDlgCtrlID
DrawFrameControl
GetWindowTextLengthW
GetScrollInfo
GetWindowTextW
CopyRect
InvalidateRgn
GetSystemMetrics
GetSysColor
CharLowerW
SetActiveWindow
GetNextDlgTabItem
CallNextHookEx
WindowFromPoint
SetWindowsHookExW
UnhookWindowsHookEx
FrameRect
DrawTextW
IsRectEmpty
RedrawWindow
InflateRect
GetMessagePos
GetWindowDC
TrackMouseEvent
ReleaseDC
NotifyWinEvent
DestroyMenu
MonitorFromPoint
RegisterClassW
CreatePopupMenu
TrackPopupMenuEx
AppendMenuW
GetActiveWindow
GetFocus
MessageBeep
SetWindowTextW
GetDlgItem
GetMonitorInfoW
GetKeyState
PostMessageW
GetParent
CreateDialogParamW
SetTimer
SetCursor
SetCapture
KillTimer
SetFocus
GetCursorPos
CreateWindowExW
LoadCursorW
GetClassInfoExW
RegisterClassExW
PtInRect
ClientToScreen
IntersectRect
ScreenToClient
GetWindowRect
EnableWindow
ShowWindow
SetWindowPos
IsWindowEnabled
InvalidateRect
EndPaint
BeginPaint
GetClientRect
SetLayeredWindowAttributes
CallWindowProcW
DefWindowProcW
GetWindowLongW
SetWindowLongW
DestroyWindow
UnregisterClassW
SendMessageW
BeginDeferWindowPos

gdi32

FrameRgn
IntersectClipRect
GetStockObject
CreatePolygonRgn
CreateCompatibleBitmap
SetWindowOrgEx
OffsetWindowOrgEx
RestoreDC
SetDCBrushColor
SaveDC
SetViewportOrgEx
LPtoDP
CombineRgn
CreateFontIndirectW
SetDCPenColor
LineTo
MoveToEx
SetBkMode
GetObjectW
CreateRectRgnIndirect
CreateRectRgn
GetTextExtentPoint32W
GetTextColor
GetBkColor
GetCurrentObject
CreatePen
OffsetRgn
GetTextMetricsW
SelectObject
CreateCompatibleDC
BitBlt
FillRgn
GetDeviceCaps
ExtTextOutW
SetBkColor
SetTextColor
DeleteObject
DeleteDC

shell32

SHFileOperationW
SHQueryRecycleBinW
ord74

oleaut32

VariantInit
SysAllocString
VariantClear

shared

_PokeWindow@4
_uGetWindowText@8
_uShellExecute@24
_ModalDialog_Switch@4
_uGetOpenFileName@32
_uBrowseForFolder@12
_ModalDialog_PokeExisting@0
_GetInfiniteWaitEvent@0
_uSetWindowText@8
?g_from_system@t_font_description@@SG?AU1@H@Z
?create@t_font_description@@QBGPAUHFONT__@@XZ
_uExceptFilterProc@4
_stricmp_utf8_ex@16
??0uCallStackTracker@@QAE@PBD@Z
??1uCallStackTracker@@QAE@XZ
_FindOwningPopup@4
_uFormatSystemErrorMessage@8
_ModalDialog_CanCreateNew@0
_uAddStringLower@12
_stricmp_utf8@8
_uGetFileAttributes@4
_uPrintCrashInfo_OnEvent@8
_uBugCheck@0
_stricmp_utf8_partial@12
_uEvalKnownFolder@4

msvcp140

?__ExceptionPtrAssign@@YAXPAXPBX@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrCreate@@YAXPAX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z

shlwapi

SHAutoComplete

comctl32

ord413
ord410

msimg32

GradientFill

oleacc

LresultFromObject
AccessibleObjectFromWindow

gdiplus

GdipDrawLineI
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipDeletePen
GdipCreatePen1
GdiplusStartup
GdiplusShutdown

vcruntime140

_except_handler3
__CxxFrameHandler3
__std_terminate
_purecall
__std_exception_copy
__std_exception_destroy
strrchr
memset
strstr
memcpy
memmove
strchr
memcmp
__current_exception
__current_exception_context
_except_handler4_common
_CxxThrowException
__std_type_info_destroy_list

api-ms-win-crt-runtime-l1-1-0

abort
_invalid_parameter_noinfo
_errno
_initterm_e
_initterm
terminate
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_beginthreadex
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-string-l1-1-0

strncmp
_strdup
strcmp
wcsnlen
wcslen
strlen

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
free
realloc
_recalloc
_expand

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s

api-ms-win-crt-math-l1-1-0

fabs
__libm_sse2_pow
ceil
sqrt
lround

api-ms-win-crt-utility-l1-1-0

srand
rand

uxtheme

SetWindowTheme
DrawThemeBackground
IsThemePartDefined
CloseThemeData
OpenThemeData

ole32

CoUninitialize
CoInitialize
CoCreateInstance
CreateStreamOnHGlobal
RegisterDragDrop
RevokeDragDrop
ReleaseStgMedium
DoDragDrop

Exports

Exports

foobar2000_get_interface

Sections

.text
Size: 253KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e433b76f910d75d82591c2f2e363b808

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

oleaut32

shared

msvcp140

shlwapi

comctl32

msimg32

oleacc

gdiplus

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

uxtheme

ole32

Exports

Exports

Sections

.text Size: 253KB - Virtual size: 252KB

.rdata Size: 70KB - Virtual size: 70KB

.data Size: 6KB - Virtual size: 9KB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 20KB - Virtual size: 19KB

.text
Size: 253KB - Virtual size: 252KB

.rdata
Size: 70KB - Virtual size: 70KB

.data
Size: 6KB - Virtual size: 9KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 20KB - Virtual size: 19KB