897205a12236973c97c967a1f5a08335dc4de62a54191de8f61ecd886f16e455[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

897205a12236973c97c967a1f5a08335dc4de62a54191de8f61ecd886f16e455.exe
Size

1.8MB
MD5

2b3ec458d3ccd7661c455c8184f88adc
SHA1

34df791d2d5525f97aca1c1f75a4b206e040c40b
SHA256

897205a12236973c97c967a1f5a08335dc4de62a54191de8f61ecd886f16e455
SHA512

801fe1b25fd48247290c215fbe17246deab0af9c35ebc83514cfb89e01de4a32a4a18c73dabe6c4216fabd8396c40cd24850b7ac15d0eb70475dc384aba1a49b
SSDEEP

24576:R/XoUK0zzcFmMCwtZp74ydWAdAj9lOIdqeD1Xo16pQo3DlN4E7fema:R/XrzcFjPp74inkOIdqeDUW3X4yfi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
897205a12236973c97c967a1f5a08335dc4de62a54191de8f61ecd886f16e455.exe

Files

897205a12236973c97c967a1f5a08335dc4de62a54191de8f61ecd886f16e455.exe
.exe windows:6 windows x64 arch:x64

caab291711d21e4964574af4fa70150a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

F:\proj_20211005_RtkAudUService_Luke_IGCCTray_ShuiWen_Bg_Crash\20211005_modify\Release\x64\RtkAudUService64.pdb

Imports

oleaut32

SafeArrayAccessData
SafeArrayUnaccessData
SysAllocStringLen
SysFreeString
SafeArrayPutElement
LoadTypeLibEx
BSTR_UserMarshal64
LPSAFEARRAY_UserSize64
SafeArrayCreate
BSTR_UserSize64
BSTR_UserFree64
VariantClear
LPSAFEARRAY_UserMarshal
SafeArrayCreateVector
LPSAFEARRAY_UserUnmarshal64
BSTR_UserMarshal
BSTR_UserUnmarshal
LPSAFEARRAY_UserMarshal64
LPSAFEARRAY_UserFree64
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserFree
BSTR_UserUnmarshal64
SysAllocString
LPSAFEARRAY_UserSize
VariantInit
VariantCopy
BSTR_UserFree
BSTR_UserSize

rpcrt4

RpcServerUseProtseqEpW
NdrClientCall3
NdrStubForwardingFunction
NdrServerCallAll
NdrServerCall2
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
NdrStubCall3
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
RpcEpUnregister
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
CStdStubBuffer_Invoke
NdrCStdStubBuffer_Release
RpcBindingVectorFree
NdrCStdStubBuffer2_Release
IUnknown_Release_Proxy
RpcServerRegisterIf3
RpcServerInqBindings
CStdStubBuffer_AddRef
RpcEpRegisterW
RpcServerListen
RpcServerUnregisterIf
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy

api-ms-win-core-com-l1-1-0

PropVariantClear
CLSIDFromString
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoRevokeClassObject
CoRegisterClassObject
StringFromCLSID
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
CoSetProxyBlanket
CoInitializeSecurity
CoFreeUnusedLibrariesEx

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapReAlloc
HeapAlloc
HeapFree
HeapSize
HeapDestroy

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleA
LoadStringW
GetModuleHandleW
LoadLibraryExW
LockResource
LoadResource
GetModuleFileNameW
FindResourceExW
FreeLibrary
SizeofResource
GetProcAddress

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
FindResourceW

api-ms-win-core-string-obsolete-l1-1-0

lstrcpyW
lstrcmpA
lstrcmpW
lstrlenW

api-ms-win-core-file-l1-1-0

FileTimeToLocalFileTime
GetFileAttributesW
WriteFile
CreateFileW
ReadFile
DeleteFileW
QueryDosDeviceW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-synch-l1-1-0

ResetEvent
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
CreateEventExW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetWaitableTimer
CreateEventW
InitializeCriticalSection
SetEvent
CreateMutexW
WaitForSingleObject
CancelWaitableTimer
WaitForSingleObjectEx

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetTickCount
GetLocalTime
GetSystemTimeAsFileTime
GetSystemTime

api-ms-win-core-string-l1-1-0

GetStringTypeW
WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
CreateProcessAsUserW
TlsFree
ProcessIdToSessionId
CreateThread
TlsGetValue
TlsAlloc
GetExitCodeProcess
CreateProcessW
SwitchToThread
TlsSetValue
GetStartupInfoW
GetCurrentThreadId
SetProcessShutdownParameters
GetCurrentProcessId
OpenProcessToken
TerminateProcess

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoUninitialize
RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects
CreateWaitableTimerW

propsys

InitPropVariantFromCLSID

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegSetKeySecurity
RegGetKeySecurity
RegQueryInfoKeyW
RegCreateKeyExW
RegOpenKeyExW
RegNotifyChangeKeyValue
RegEnumValueW
RegCloseKey
RegEnumKeyExW
RegGetValueW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW
RegCreateKeyW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
OutputDebugStringA

api-ms-win-core-synch-l1-2-0

Sleep

ext-ms-win-shell32-shellfolders-l1-1-0

SHGetFolderPathW
SHGetSpecialFolderPathW

api-ms-win-core-privateprofile-l1-1-0

GetProfileIntW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-localization-l1-2-0

FormatMessageW
LCMapStringW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-heap-obsolete-l1-1-0

LocalSize

api-ms-win-core-kernel32-legacy-l1-1-0

WTSGetActiveConsoleSessionId
GetSystemPowerStatus

api-ms-win-security-base-l1-1-0

AddAce
GetAce
AddAccessAllowedAceEx
InitializeAcl
AllocateAndInitializeSid
GetAclInformation
CreateWellKnownSid
FreeSid
DeleteAce
GetLengthSid
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
AdjustTokenPrivileges
InitializeSecurityDescriptor
SetTokenInformation
DuplicateTokenEx

api-ms-win-core-namedpipe-l1-1-0

ConnectNamedPipe
CreateNamedPipeW
DisconnectNamedPipe

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

bcrypt

BCryptImportKeyPair
BCryptEncrypt
BCryptDestroyKey
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW
SetServiceStatus
StartServiceCtrlDispatcherW

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenSCManagerW
DeleteService
CreateServiceW
OpenServiceW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus
ControlService

api-ms-win-service-management-l2-1-0

QueryServiceStatusEx

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-appmodel-runtime-l1-1-1

FindPackagesByPackageFamily

api-ms-win-mm-misc-l1-1-0

mmioWrite
mmioSetInfo
mmioClose
mmioGetInfo
mmioCreateChunk
mmioRead
mmioSeek
mmioAdvance
mmioDescend
mmioAscend
mmioOpenW

api-ms-win-core-toolhelp-l1-1-0

Process32FirstW
Process32NextW
CreateToolhelp32Snapshot

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

userenv

CreateEnvironmentBlock

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-memory-l1-1-0

ReadProcessMemory

crypt32

CertCloseStore
CertFreeCertificateContext
CertGetNameStringW
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
CryptMsgClose
CryptDecodeObject

api-ms-win-core-threadpool-l1-2-0

SubmitThreadpoolWork
CreateThreadpoolWork

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
TraceMessage
GetTraceLoggerHandle

setupapi

SetupDiGetDeviceInstanceIdW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetDevicePropertyW
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW

wtsapi32

WTSRegisterSessionNotification
WTSQueryUserToken

kernel32

WinExec
WriteProfileStringW

user32

RegisterClassW
CallNextHookEx
UnregisterDeviceNotification
RegisterDeviceNotificationW
SetTimer
LoadCursorW
KillTimer
GetClassNameA
TranslateMessage
SetWinEventHook
UnhookWinEvent
CreateWindowExW
ShowWindow
UnhookWindowsHookEx
GetMessageW
SendInput
FindWindowExW
DispatchMessageW
DefWindowProcW
LoadIconW
RegisterPowerSettingNotification
SendMessageW
SetWindowsHookExW

advapi32

DeregisterEventSource
ReportEventW
RegisterEventSourceW
GetUserNameW

ole32

CoInitialize

avrt

AvSetMmThreadCharacteristicsW
AvRevertMmThreadCharacteristics

ntdll

NtQueryInformationProcess

wininet

InternetReadFile
InternetOpenW
InternetOpenUrlW
InternetCloseHandle

api-ms-win-crt-runtime-l1-1-0

_c_exit
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo
_errno
_register_onexit_function
_resetstkoflw
_crt_atexit
terminate
abort
_cexit
_exit
exit
_initterm_e
_configure_wide_argv
_initterm
_get_wide_winmain_command_line
_invalid_parameter_noinfo_noreturn
_seh_filter_exe
_set_app_type
_initialize_wide_environment

api-ms-win-crt-string-l1-1-0

wcscspn
wcsspn
strcpy_s
__strncnt
islower
wcsncmp
wcsnlen
towupper
_wcsdup
isupper
strcspn
wmemcpy_s
wcscat_s
iswspace
_wcsupr_s
wcscpy_s
wcstok_s
_wcsicmp

api-ms-win-crt-stdio-l1-1-0

_flushall
__stdio_common_vsprintf_s
__stdio_common_vsprintf
_wfopen_s
fread
fgets
fseek
fputs
fflush
fputws
_wfsopen
__p__commode
__stdio_common_vswprintf_s
__stdio_common_vswprintf
_get_stream_buffer_pointers
fgetc
fgetpos
fputc
__acrt_iob_func
__stdio_common_vfwprintf
__stdio_common_vfprintf_s
fsetpos
_set_fmode
_fseeki64
setvbuf
ungetc
__stdio_common_vfprintf
fgetwc
fputwc
fwrite
ungetwc
fclose
ftell

api-ms-win-crt-convert-l1-1-0

wcstol
_wtoi
wcstoul

api-ms-win-crt-heap-l1-1-0

_set_new_mode
malloc
free
realloc
calloc
_recalloc
_callnewh

api-ms-win-crt-math-l1-1-0

powf
frexp
log10f
atan2f
__setusermatherr
asinf

api-ms-win-crt-locale-l1-1-0

_lock_locales
___lc_codepage_func
setlocale
___lc_locale_name_func
__pctype_func
___mb_cur_max_func
_unlock_locales
localeconv
_configthreadlocale

api-ms-win-crt-multibyte-l1-1-0

_mbsstr
_mbschr

shlwapi

PathFileExistsW

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
RtlUnwind
RtlVirtualUnwind
RtlPcToFileHeader

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file

Sections

.text
Size: 707KB - Virtual size: 706KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 412KB - Virtual size: 412KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 139KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 576KB - Virtual size: 580KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

caab291711d21e4964574af4fa70150a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

oleaut32

rpcrt4

api-ms-win-core-com-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-synch-l1-2-1

propsys

api-ms-win-core-registry-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-synch-l1-2-0

ext-ms-win-shell32-shellfolders-l1-1-0

api-ms-win-core-privateprofile-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-security-base-l1-2-2

api-ms-win-security-provider-l1-1-0

api-ms-win-core-registry-l1-1-1

bcrypt

api-ms-win-service-core-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-appmodel-runtime-l1-1-1

api-ms-win-mm-misc-l1-1-0

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

userenv

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-memory-l1-1-0

crypt32

api-ms-win-core-threadpool-l1-2-0

api-ms-win-eventing-classicprovider-l1-1-0

setupapi

wtsapi32

kernel32

user32

advapi32

ole32

avrt

ntdll

wininet

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

.text
Size: 707KB - Virtual size: 706KB

.orpc
Size: 512B - Virtual size: 148B

.rdata
Size: 412KB - Virtual size: 412KB

.data
Size: 23KB - Virtual size: 33KB

.pdata
Size: 29KB - Virtual size: 28KB

.rsrc
Size: 139KB - Virtual size: 138KB

.reloc
Size: 576KB - Virtual size: 580KB