TAKBIR VIP[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

TAKBIR VIP.zip
Size

1.3MB
MD5

44d78fb13dfd9d616d9ed0aa6a439718
SHA1

1c88d8b0a6fc0df1c749a3f904a7dc4b3c7d916f
SHA256

1b7bfab72d989cb5de3553aa5eb555c27a863431d1ba8986b594e67be306ce57
SHA512

d7f348a3c702c7810c31b05cf348c662a09d1e70a08d1910fdcd2886d51a1e4435d9e9d34f597902bfd83fcce426bbe0db7dd2100dd30ba3e76f7c0ef295330a
SSDEEP

24576:DLtP5jdzWseKtF7qr8gRFBKak1c9mDGFhj0Znpkq7np8z0nTprmlJ3:DLR5BCitF7qo/aaFDGAdph7p8z0nFrC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/TAKBIR VIP.exe

Files

TAKBIR VIP.zip
.zip

Password: 1
TAKBIR VIP.exe
.exe windows:6 windows x64 arch:x64

Password: 1

ff3d6b7188610f553a0f7707376d369a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\PC\Desktop\SpeedyBypass C++\j loader\examples\example_win32_directx11\Release\Speedy Bypass.pdb

Imports

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

LocalFree
EnterCriticalSection
LeaveCriticalSection
SleepEx
GetSystemDirectoryA
VerifyVersionInfoA
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
FormatMessageA
SetLastError
QueryFullProcessImageNameW
CreateFileA
GetCurrentProcess
ReleaseSRWLockExclusive
GetFileSizeEx
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
VirtualQueryEx
AllocConsole
GetTickCount
ReadProcessMemory
VirtualProtectEx
CreateThread
CloseHandle
Process32Next
Sleep
CreateToolhelp32Snapshot
OpenProcess
OutputDebugStringA
WriteProcessMemory
Process32First
QueryPerformanceCounter
FreeLibrary
VerSetConditionMask
ReadFile
HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
CreateFileW
GetModuleHandleW
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
GetLastError
HeapDestroy
HeapSize
InitializeCriticalSectionEx
AcquireSRWLockExclusive
DeleteCriticalSection
VirtualProtect
CreateFileMappingW
GetModuleFileNameA

user32

DestroyWindow
CreateWindowExW
GetSystemMetrics
UnregisterClassW
RegisterClassExW
ShowWindow
MessageBoxA
GetWindowRect
DefWindowProcA
TranslateMessage
LoadIconA
PeekMessageA
PostQuitMessage
FindWindowA
UpdateWindow
MoveWindow
DispatchMessageA
LoadCursorA
ScreenToClient
GetCapture
ClientToScreen
TrackMouseEvent
GetForegroundWindow
SetCapture
SetCursor
GetClientRect
IsWindowUnicode
ReleaseCapture
SetCursorPos
GetCursorPos
SetClipboardData
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
GetKeyState

shell32

ShellExecuteA

msvcp140

?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?setf@ios_base@std@@QEAAHHH@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

normaliz

IdnToAscii

wldap32

ord26
ord200
ord27
ord30
ord22
ord41
ord32
ord50
ord33
ord79
ord45
ord211
ord60
ord301
ord46
ord35
ord217
ord143

crypt32

CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

ws2_32

WSAGetLastError
bind
connect
closesocket
getsockname
ntohl
gethostname
recv
sendto
listen
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
getsockopt
htonl
accept
WSACleanup
WSAStartup
WSAIoctl
getpeername
WSASetLastError
socket
setsockopt
ntohs
htons
send

rpcrt4

UuidToStringA
UuidCreate
RpcStringFreeA

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate
__std_exception_destroy
__std_exception_copy
strstr
strrchr
longjmp
memcpy
memmove
memset
memchr
memcmp
_CxxThrowException
strchr
__current_exception
__intrinsic_setjmp
__current_exception_context
__C_specific_handler

api-ms-win-crt-stdio-l1-1-0

_wfopen
__stdio_common_vsprintf
__p__commode
_lseeki64
fflush
fread
__stdio_common_vsscanf
fclose
feof
_read
fputs
fopen
_write
_close
_open
__stdio_common_vfprintf
ftell
_popen
_pclose
fgets
fputc
__acrt_iob_func
fseek
_set_fmode
fwrite

api-ms-win-crt-utility-l1-1-0

rand
qsort

api-ms-win-crt-string-l1-1-0

strcmp
strncmp
_strdup
strncpy
strpbrk
isupper
strcspn
strspn
tolower

api-ms-win-crt-heap-l1-1-0

malloc
_set_new_mode
calloc
free
realloc
_callnewh
_msize

api-ms-win-crt-runtime-l1-1-0

_errno
_resetstkoflw
strerror
__sys_nerr
_invalid_parameter_noinfo
exit
_invalid_parameter_noinfo_noreturn
_wassert
_beginthreadex
_getpid
_register_thread_local_exe_atexit_callback
_c_exit
system
_exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
terminate

api-ms-win-crt-convert-l1-1-0

strtoul
atoi
strtol
strtoull
strtod
strtoll

api-ms-win-crt-math-l1-1-0

powf
_dclass
acosf
fmodf
cos
__setusermatherr
pow
ceilf
sqrtf
roundf
sin
sinf
cosf

api-ms-win-crt-filesystem-l1-1-0

_unlink
_stat64
_fstat64
_access

api-ms-win-crt-locale-l1-1-0

localeconv
_configthreadlocale

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64

advapi32

CryptImportKey
AddAccessAllowedAce
GetLengthSid
GetTokenInformation
InitializeAcl
IsValidSid
SetSecurityInfo
CopySid
ConvertSidToStringSidA
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptEncrypt
OpenProcessToken
CryptDestroyKey

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 315KB - Virtual size: 314KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 691KB - Virtual size: 695KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: 1

Password: 1

ff3d6b7188610f553a0f7707376d369a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

d3dx11_43

d3d11

d3dcompiler_43

kernel32

user32

shell32

msvcp140

imm32

dwmapi

normaliz

wldap32

crypt32

ws2_32

rpcrt4

psapi

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-time-l1-1-0

advapi32

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 315KB - Virtual size: 314KB

.data Size: 691KB - Virtual size: 695KB

.pdata Size: 51KB - Virtual size: 50KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 315KB - Virtual size: 314KB

.data
Size: 691KB - Virtual size: 695KB

.pdata
Size: 51KB - Virtual size: 50KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 4KB - Virtual size: 4KB