eb93a4d8e5709bf7c4711b0b30a84257a4b3dab04dfa829f845642be866b68ee

Sharing

Copy URL Twitter E-mail

General

Target

eb93a4d8e5709bf7c4711b0b30a84257a4b3dab04dfa829f845642be866b68ee
Size

551KB
MD5

d2a2454eefc3a6f91a3e3cb6420e42cf
SHA1

85415d46fdc628617451175f1ba0957f322e87df
SHA256

eb93a4d8e5709bf7c4711b0b30a84257a4b3dab04dfa829f845642be866b68ee
SHA512

a08598a9a1ddf31c91975b5e13d697b96d7dc3522072e9a6637964e0cda9840c76cbd3cedc283e3aecbdf86e8a957c177d698f132117312ebf629a3f01d9e669
SSDEEP

12288:7zncyXsCqDeHOIP1ytcaqGoyCio5ghrfq8pG60LvS:77cJCqD+OI0S1yCIxfq8q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eb93a4d8e5709bf7c4711b0b30a84257a4b3dab04dfa829f845642be866b68ee

Files

eb93a4d8e5709bf7c4711b0b30a84257a4b3dab04dfa829f845642be866b68ee
.dll windows:6 windows x64 arch:x64

a2a4b2ac3c7011783056118b90926d55

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Sources\foobar2000-2.1\foobar2000\x64\Release\foo_unpack.pdb

Imports

kernel32

SetThreadPriority
GetSystemDirectoryW
CreateEventW
LoadLibraryW
SetThreadExecutionState
EnterCriticalSection
ReleaseSemaphore
GetProcessAffinityMask
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
SetEvent
CreateThread
ResetEvent
DeleteCriticalSection
CreateSemaphoreW
LocalFileTimeToFileTime
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetSystemTime
CompareStringW
GetCPInfo
MultiByteToWideChar
IsDBCSLeadByte
WideCharToMultiByte
LocalFree
GetCurrentThreadId
GetModuleHandleW
GetModuleHandleA
GetSystemInfo
GlobalMemoryStatusEx
GetSystemTimeAsFileTime
DosDateTimeToFileTime
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
SetThreadAffinityMask
ResumeThread
FreeLibrary
GetProcAddress
GetCurrentDirectoryW
FoldStringW
GetVersionExW
FindClose
FindFirstFileW
GetCurrentProcessId
GetFileAttributesW
SetFilePointer
ReadFile
MoveFileW
GetShortPathNameW
GetLongPathNameW
CloseHandle
DeleteFileW
CreateFileW
CreateHardLinkW
SetFileTime
RemoveDirectoryW
DeviceIoControl
GetCurrentProcess
CreateDirectoryW
GetLastError
Sleep
AreFileApisANSI
GetFileType
GetStdHandle
InitializeCriticalSectionEx
InitializeSListHead
DisableThreadLibraryCalls
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
InitOnceBeginInitialize
InitOnceComplete
IsDebuggerPresent
OutputDebugStringW
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetTickCount64
SetLastError

user32

CharToOemA
OemToCharA
CharUpperW
CharLowerW
OemToCharBuffA
CharToOemBuffW

advapi32

LookupPrivilegeValueW
OpenProcessToken
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
SetFileSecurityW
AdjustTokenPrivileges

ole32

CoSetProxyBlanket
CoCreateInstance
CoCreateGuid

oleaut32

SysAllocStringLen
VariantCopy
VariantClear
SysStringLen
SysFreeString
SysAllocString

zlib1

inflateInit2_
crc32
inflateReset
inflate
inflateEnd

shared

uFormatSystemErrorMessage
GetInfiniteWaitEvent
uGetTempPath
stricmp_utf8
??0uCallStackTracker@@QEAA@PEBD@Z
??1uCallStackTracker@@QEAA@XZ
uPrintCrashInfo_OnEvent
uBugCheck

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrCurrentException@@YAXPEAX@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception
strchr
strrchr
__C_specific_handler
strstr
memmove
memset
memcmp
memcpy
wcsrchr
_CxxThrowException
__std_type_info_destroy_list
__std_exception_destroy
__std_exception_copy
__current_exception_context
wcschr
__std_terminate
_purecall
wcsstr

api-ms-win-crt-runtime-l1-1-0

abort
_seh_filter_dll
_invalid_parameter_noinfo_noreturn
exit
_configure_narrow_argv
_beginthreadex
_initialize_narrow_environment
_initterm_e
_initterm
terminate
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table

api-ms-win-crt-string-l1-1-0

_strdup
_wcsicmp
strlen
wcsncpy
_wcsdup
wcsncmp
wcspbrk
strncmp

api-ms-win-crt-heap-l1-1-0

free
realloc
_callnewh
malloc

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-time-l1-1-0

clock

api-ms-win-crt-math-l1-1-0

lround

Exports

Exports

foobar2000_get_interface

Sections

.text
Size: 448KB - Virtual size: 447KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.movehcs
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a2a4b2ac3c7011783056118b90926d55

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

oleaut32

zlib1

shared

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 448KB - Virtual size: 447KB

.rdata Size: 74KB - Virtual size: 73KB

.data Size: 4KB - Virtual size: 43KB

.pdata Size: 19KB - Virtual size: 18KB

.rsrc Size: 512B - Virtual size: 472B

.reloc Size: 3KB - Virtual size: 3KB

.movehcs Size: 512B - Virtual size: 4KB

.text
Size: 448KB - Virtual size: 447KB

.rdata
Size: 74KB - Virtual size: 73KB

.data
Size: 4KB - Virtual size: 43KB

.pdata
Size: 19KB - Virtual size: 18KB

.rsrc
Size: 512B - Virtual size: 472B

.reloc
Size: 3KB - Virtual size: 3KB

.movehcs
Size: 512B - Virtual size: 4KB